Overview

overview

10

Static

static

3

2026-08-04...ck.exe

windows10-2004-x64

10

2026-08-04...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 08:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
  • Size 1.6MB
  • Sample260804-jypvbazwbt
  • SHA256 e9846b6846473cf180081389365f364c76c618937f2fd3a45c2b98f01fd5fde0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 8 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 8 IoCs
    defense_evasiontrojan
  • Renames multiple (124) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 8 IoCs
    execution
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 16 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4144
    • C:\Users\Admin\mucMwUkM\twMgQkMU.exe
      "C:\Users\Admin\mucMwUkM\twMgQkMU.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:4772
    • C:\ProgramData\xswYQMsI\YqIgsUgU.exe
      "C:\ProgramData\xswYQMsI\YqIgsUgU.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:1648
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1256
      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2612
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4940
          • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2344
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1236
              • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2940
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2276
                  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:2808
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:3524
                      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                        11⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:4452
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:572
                          • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                            13⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:5784
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:908
                              • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                15⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:4120
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  PID:1816
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                  16⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry key
                                  PID:5952
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry key
                                  PID:256
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                  16⤵
                                  • UAC bypass
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry key
                                  PID:5944
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZWQcUYIM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4540
                                  • C:\Windows\SysWOW64\cscript.exe
                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                    17⤵
                                    • Executes a VBScript file via the Windows Script Host.
                                    • System Location Discovery: System Language Discovery
                                    PID:1296
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                              14⤵
                              • Modifies visibility of file extensions in Explorer
                              • System Location Discovery: System Language Discovery
                              • Modifies registry key
                              PID:4836
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                              14⤵
                              • System Location Discovery: System Language Discovery
                              • Modifies registry key
                              PID:4528
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                              14⤵
                              • UAC bypass
                              • System Location Discovery: System Language Discovery
                              • Modifies registry key
                              PID:4336
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tyMkoEsU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:5644
                              • C:\Windows\SysWOW64\cscript.exe
                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                15⤵
                                • Executes a VBScript file via the Windows Script Host.
                                • System Location Discovery: System Language Discovery
                                PID:4608
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                          12⤵
                          • Modifies visibility of file extensions in Explorer
                          • System Location Discovery: System Language Discovery
                          • Modifies registry key
                          PID:1952
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Modifies registry key
                          PID:3140
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                          12⤵
                          • UAC bypass
                          • System Location Discovery: System Language Discovery
                          • Modifies registry key
                          PID:3984
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bsogUMAw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                          12⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:4776
                          • C:\Windows\SysWOW64\cscript.exe
                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                            13⤵
                            • Executes a VBScript file via the Windows Script Host.
                            • System Location Discovery: System Language Discovery
                            PID:3264
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                      10⤵
                      • Modifies visibility of file extensions in Explorer
                      • System Location Discovery: System Language Discovery
                      • Modifies registry key
                      PID:3456
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Modifies registry key
                      PID:5604
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                      10⤵
                      • UAC bypass
                      • System Location Discovery: System Language Discovery
                      • Modifies registry key
                      PID:2444
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eEoUokcs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:4444
                      • C:\Windows\SysWOW64\cscript.exe
                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                        11⤵
                        • Executes a VBScript file via the Windows Script Host.
                        • System Location Discovery: System Language Discovery
                        PID:5436
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • System Location Discovery: System Language Discovery
                  • Modifies registry key
                  PID:4952
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry key
                  PID:5268
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                  8⤵
                  • UAC bypass
                  • System Location Discovery: System Language Discovery
                  • Modifies registry key
                  PID:4364
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KqQMcMgo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1640
                  • C:\Windows\SysWOW64\cscript.exe
                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                    9⤵
                    • Executes a VBScript file via the Windows Script Host.
                    • System Location Discovery: System Language Discovery
                    PID:2288
            • C:\Windows\SysWOW64\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
              6⤵
              • Modifies visibility of file extensions in Explorer
              • System Location Discovery: System Language Discovery
              • Modifies registry key
              PID:3196
            • C:\Windows\SysWOW64\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry key
              PID:3944
            • C:\Windows\SysWOW64\reg.exe
              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
              6⤵
              • UAC bypass
              • System Location Discovery: System Language Discovery
              • Modifies registry key
              PID:2752
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CWUAYAQQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1744
              • C:\Windows\SysWOW64\cscript.exe
                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                7⤵
                • Executes a VBScript file via the Windows Script Host.
                • System Location Discovery: System Language Discovery
                PID:5844
        • C:\Windows\SysWOW64\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
          4⤵
          • Modifies visibility of file extensions in Explorer
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:2192
        • C:\Windows\SysWOW64\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:5988
        • C:\Windows\SysWOW64\reg.exe
          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
          4⤵
          • UAC bypass
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:6100
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ziAocAEE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5532
          • C:\Windows\SysWOW64\cscript.exe
            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
            5⤵
            • Executes a VBScript file via the Windows Script Host.
            • System Location Discovery: System Language Discovery
            PID:5068
    • C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      2⤵
      • Modifies visibility of file extensions in Explorer
      • System Location Discovery: System Language Discovery
      • Modifies registry key
      PID:6004
    • C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry key
      PID:2492
    • C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      2⤵
      • UAC bypass
      • System Location Discovery: System Language Discovery
      • Modifies registry key
      PID:4760
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XYYAMAYA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2912
      • C:\Windows\SysWOW64\cscript.exe
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        3⤵
        • Executes a VBScript file via the Windows Script Host.
        • System Location Discovery: System Language Discovery
        PID:3428
  • C:\Users\Admin\mucMwUkM\twMgQkMU.exe
    C:\Users\Admin\mucMwUkM\twMgQkMU.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    PID:3124
  • C:\ProgramData\ZooMwMIs\qCMQscAQ.exe
    C:\ProgramData\ZooMwMIs\qCMQscAQ.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    PID:3904
  • C:\ProgramData\xswYQMsI\YqIgsUgU.exe
    C:\ProgramData\xswYQMsI\YqIgsUgU.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    PID:3492

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        2
        T1059

        Visual Basic

        1
        T1059.005

        Windows Command Shell

        1
        T1059.003

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Privilege Escalation

        Abuse Elevation Control Mechanism

        1
        T1548

        Bypass User Account Control

        1
        T1548.002

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Defense Evasion

        Abuse Elevation Control Mechanism

        1
        T1548

        Bypass User Account Control

        1
        T1548.002

        Hide Artifacts

        1
        T1564

        Hidden Files and Directories

        1
        T1564.001

        Impair Defenses

        1
        T1562

        Disable or Modify Tools

        1
        T1562.001

        Modify Registry

        4
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        System Information Discovery

        1
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        OyYY.txt
        • Path C:\ProgramData\OyYY.txt
        • Size 9KB
        • SHA256 cdba811bb5ef7f92177cccf22e3f2ce57adc052d1371d7eb49a60c20815e0964
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qCMQscAQ.exe
        • Path C:\ProgramData\ZooMwMIs\qCMQscAQ.exe
        • Size 1.6MB
        • SHA256 7efedce3b32de584aa7befcd02f7bf95e693b1fb4cbb72b31b8b9d52d67e8279
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        YqIgsUgU.exe
        • Path C:\ProgramData\xswYQMsI\YqIgsUgU.exe
        • Size 1.6MB
        • SHA256 99ca9b6234369388eecb728cfced1df4a0a4c0d6e63452c40e14f57b1b410172
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        YqIgsUgU.inf
        • Path C:\ProgramData\xswYQMsI\YqIgsUgU.inf
        • Size 4B
        • SHA256 a83ec83a8be5b81ad59fb3397f88c4e4c2f9da67b6908c38f7d89479c2d9e579
        • MD5 SHA1 SHA512
        Submit Download

        YqIgsUgU.inf
        • Path C:\ProgramData\xswYQMsI\YqIgsUgU.inf
        • Size 4B
        • SHA256 8f9fea0b35731ccc9452a814bbdd9536a01f5dbbed6931a4fe3f8eb0a7b3a271
        • MD5 SHA1 SHA512
        Submit Download

        2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
        • Size 5KB
        • SHA256 98817a572430813ca4ca2787dab20573f7864c5168ac6912f34d14b49e7bd7c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        XYYAMAYA.bat
        • Path C:\Users\Admin\AppData\Local\Temp\XYYAMAYA.bat
        • Size 112B
        • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        file.vbs
        • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
        • Size 19B
        • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
        • MD5 SHA1 SHA512
        Submit Download

        twMgQkMU.exe
        • Path C:\Users\Admin\mucMwUkM\twMgQkMU.exe
        • Size 1.6MB
        • SHA256 7ec98b0009bf2b535e302f8d6b159180ad9f9f82a7a719c6fa2cedc2fbcf44b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        twMgQkMU.inf
        • Path C:\Users\Admin\mucMwUkM\twMgQkMU.inf
        • Size 4B
        • SHA256 bc8791235bef677e772d944ed279227b7877f9b721bcf6a887c05366534f79a2
        • MD5 SHA1 SHA512
        Submit Download

        twMgQkMU.inf
        • Path C:\Users\Admin\mucMwUkM\twMgQkMU.inf
        • Size 4B
        • SHA256 541f761f712c72d9e2d41352b173f501d966411d3d167e6717ebc600402a2f33
        • MD5 SHA1 SHA512
        Submit Download

        twMgQkMU.inf
        • Path C:\Users\Admin\mucMwUkM\twMgQkMU.inf
        • Size 4B
        • SHA256 1b69cc5df73443b6fcf3175d68d5a7537f86ee1e730af80c6b9bfc43e2dd1836
        • MD5 SHA1 SHA512
        Submit Download

        twMgQkMU.inf
        • Path C:\Users\Admin\mucMwUkM\twMgQkMU.inf
        • Size 4B
        • SHA256 da9c6c38e3e14b9a835a37b11adce7d5cc932104b032f2c392c812ff3fe4d2a6
        • MD5 SHA1 SHA512
        Submit Download

        twMgQkMU.inf
        • Path C:\Users\Admin\mucMwUkM\twMgQkMU.inf
        • Size 4B
        • SHA256 79972373990ecd6c0d2db8a9c6a4f4bb0227009e731b67771776f51f832151cf
        • MD5 SHA1 SHA512
        Submit Download

        twMgQkMU.inf
        • Path C:\Users\Admin\mucMwUkM\twMgQkMU.inf
        • Size 4B
        • SHA256 8869de8ada003713de4705dcc7cff422d521b29e95fd3d84bdb64fc97a1e2bdd
        • MD5 SHA1 SHA512
        Submit Download

        twMgQkMU.inf
        • Path C:\Users\Admin\mucMwUkM\twMgQkMU.inf
        • Size 4B
        • SHA256 942f2152371dc9e9f421e2bcf9d8f960b205cd6c2150a581d5ecb318623d7db6
        • MD5 SHA1 SHA512
        Submit Download

        AAwC.exe
        • Path C:\Windows\AAwC.exe
        • Size 1.6MB
        • SHA256 81e4408d4e527f2ee75141d6658adf865f93b69f5528630fe444fc17174e373a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AUEC.exe
        • Path C:\Windows\AUEC.exe
        • Size 1.7MB
        • SHA256 335fa6773f7eb8961c0751aa1bd141e1dce976c75145060d11662cdc71c6ec10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AcUq.exe
        • Path C:\Windows\AcUq.exe
        • Size 1.6MB
        • SHA256 4bf555f470d3126cfbef51e9867159920e2739267fa71ff8ca01daedd5a62fd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AeIc.ico
        • Path C:\Windows\AeIc.ico
        • Size 4KB
        • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AkUE.exe
        • Path C:\Windows\AkUE.exe
        • Size 1.8MB
        • SHA256 415b2d3f6633ec1c40ffcac51a2c62317d7d4f383acea766310fad91c80b4bc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AwkY.exe
        • Path C:\Windows\AwkY.exe
        • Size 1.9MB
        • SHA256 bdf4cda2b0e30845ff1851866c318148b32a296cf45d66704f223a48b1a5e21b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CEUU.exe
        • Path C:\Windows\CEUU.exe
        • Size 1.8MB
        • SHA256 a541e4fdd63e60033c22713a34e87a95a7c1a8fcd656090db4722aa8b7f0b6ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CwEW.exe
        • Path C:\Windows\CwEW.exe
        • Size 1.9MB
        • SHA256 c0ef17567f90911b70730daf44f745dc701dcaf6169c8e0d48ad60072608f944
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EUUQ.ico
        • Path C:\Windows\EUUQ.ico
        • Size 4KB
        • SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EcMs.exe
        • Path C:\Windows\EcMs.exe
        • Size 2.1MB
        • SHA256 4b2ee0e6a9ab867d47b2e3af83a153463d14be624020c32d8037c3aed7473646
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EgYe.exe
        • Path C:\Windows\EgYe.exe
        • Size 1.6MB
        • SHA256 095af32a085a40b51eb6f841a53b21197b67cf347f379e36e59ef23664de37c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Egog.ico
        • Path C:\Windows\Egog.ico
        • Size 4KB
        • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EkIQ.exe
        • Path C:\Windows\EkIQ.exe
        • Size 2.0MB
        • SHA256 7ef731c7310c4f78003dbd2eb5edcbd42c5f2e77c49214ca945334b590113315
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Eokq.exe
        • Path C:\Windows\Eokq.exe
        • Size 1.6MB
        • SHA256 d60b4476820e4f9193971f243c6e90d4809ef6306e1fdf52dcb9c1c165ac4a50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GEQm.exe
        • Path C:\Windows\GEQm.exe
        • Size 3.2MB
        • SHA256 60ad37c97777557acc52972dfdc81659916cb13bb3b8a3691072bcf7e273fe95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GYQa.exe
        • Path C:\Windows\GYQa.exe
        • Size 1.7MB
        • SHA256 e9985e95231a8bf61ab4bbb24a148a98ae8f54eec587c5d289819fd26689b3a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GcQE.exe
        • Path C:\Windows\GcQE.exe
        • Size 1.6MB
        • SHA256 0576de4580509f3b03d87fd12498c988839e7ec42e654c6dfe6a80ec0a88ddb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GgYi.exe
        • Path C:\Windows\GgYi.exe
        • Size 1.6MB
        • SHA256 9d16f18083afbbe2ce9480f558cb7a60eb4bc31e0b8271e5c07029b40e9f3e73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GkAo.exe
        • Path C:\Windows\GkAo.exe
        • Size 2.6MB
        • SHA256 df8ee4f6e231b9847a330b152ca6877e16c06bc11cd7f1e7b8eb813c5cdc22f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IAwo.exe
        • Path C:\Windows\IAwo.exe
        • Size 2.3MB
        • SHA256 098436e93791f35c2a3255c6789aae729df133eb6791ecd002a3aadccba46c97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IcMc.exe
        • Path C:\Windows\IcMc.exe
        • Size 1.6MB
        • SHA256 dbf62f2998d1d81b6341baa5ce0b22f548455339e1ac6489cdb3eaf3fda24de0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IocK.exe
        • Path C:\Windows\IocK.exe
        • Size 2.0MB
        • SHA256 7d3ab3128498f3dab3527ccea84cb19877f9899c501a0864e2bac90cf629a08e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        KEEc.exe
        • Path C:\Windows\KEEc.exe
        • Size 1.6MB
        • SHA256 879ccb920536fba2d5c824fce287ed6082684df81c496b24947314d7b373c571
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        KEcq.exe
        • Path C:\Windows\KEcq.exe
        • Size 2.2MB
        • SHA256 10883ef559520803b8c8c6c42483245c4b7f8d2fa2c521cdb8772a88a44cdde2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        KMEM.exe
        • Path C:\Windows\KMEM.exe
        • Size 1.8MB
        • SHA256 f7926d5a6d635f49a8f4de3446fa0eb4123a863fb9d2fa711a8f06425f39b939
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        KMQW.exe
        • Path C:\Windows\KMQW.exe
        • Size 1.8MB
        • SHA256 1c9bd7442ea6cce59a419b7275910673dd7e7df5b8093d2eeac4f61d59c4acc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        KQII.exe
        • Path C:\Windows\KQII.exe
        • Size 1.6MB
        • SHA256 37b7e1c6fb7464416b7f151c575606724c3e4d1fe1a01744412f1b7bd7260b24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        KYsO.exe
        • Path C:\Windows\KYsO.exe
        • Size 1.6MB
        • SHA256 bfa612c88832d2728f02133a3058e1d6143cdc5eba36a79a0df967f9fad85823
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        KeIo.ico
        • Path C:\Windows\KeIo.ico
        • Size 4KB
        • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        KgAA.exe
        • Path C:\Windows\KgAA.exe
        • Size 1.6MB
        • SHA256 f89d9f9a426d30b671aab692c72ad8cd4a0dc8ec19900397ad5ec766b18d6fe0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        KsIU.exe
        • Path C:\Windows\KsIU.exe
        • Size 1.7MB
        • SHA256 9c87574d307a42ee62b0ccd82e59cc141a7f788ee4d4788f59b00087baa609c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MUAw.exe
        • Path C:\Windows\MUAw.exe
        • Size 1.7MB
        • SHA256 0af9faf132e73b1527d0b05c56ff2ff64bebc461a4900077ed01859529595765
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MYoM.exe
        • Path C:\Windows\MYoM.exe
        • Size 1.7MB
        • SHA256 cf87127e228a108523ad569a9e7852e2b851e4b3caa8e1fae212d02e2e564056
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Masc.ico
        • Path C:\Windows\Masc.ico
        • Size 4KB
        • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        McMA.exe
        • Path C:\Windows\McMA.exe
        • Size 2.3MB
        • SHA256 ff100ffd0efe3d00947514ef510b46235e8b24fb6c144c8a7cb26f39c882808a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MgUm.exe
        • Path C:\Windows\MgUm.exe
        • Size 1.9MB
        • SHA256 c0fc77a395acd7e9b473875efa6ba38ad4f6cb02cb5f8d1867955f99343ba10d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MoQq.exe
        • Path C:\Windows\MoQq.exe
        • Size 2.0MB
        • SHA256 c3d23e7f57958aa580e5d195a17f604743158d2f07e3ac1a4ae6b89c71f6d14b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OMco.exe
        • Path C:\Windows\OMco.exe
        • Size 2.1MB
        • SHA256 4489906df23b5cdd8e2f6544aee8f7893dbd93ed8a2adc74135d2625fc72673f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OQgO.exe
        • Path C:\Windows\OQgO.exe
        • Size 1.6MB
        • SHA256 d948d9ac66f31c98aec8f3a776a02a76185487ccd756f8f4465643624c180c28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OsEG.exe
        • Path C:\Windows\OsEG.exe
        • Size 1.9MB
        • SHA256 29af154db9de21de1f7d1a2f47117275f9fc038a4bbf58d2446918d8710a511b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QIEQ.exe
        • Path C:\Windows\QIEQ.exe
        • Size 1.8MB
        • SHA256 c2187e7585aab3e6fea4ad789667f17b311eec34d3b7f07854d202e19819a9cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QsAu.exe
        • Path C:\Windows\QsAu.exe
        • Size 1.6MB
        • SHA256 1e1d4b9446da208efd7f015c23a55a7f745909d9c32e400da57ba4a717a10a6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QsMA.exe
        • Path C:\Windows\QsMA.exe
        • Size 1.7MB
        • SHA256 85df843f19af617a33a88fab4f636b428f948e417d2414199bd5b8ec716f89d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QsMI.exe
        • Path C:\Windows\QsMI.exe
        • Size 2.0MB
        • SHA256 3f330fea571ee7bcd870712ac84680d1acfe0316a157fa9d5b6734f1d37553f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SIkM.exe
        • Path C:\Windows\SIkM.exe
        • Size 1.9MB
        • SHA256 be1c9a700e153e82b4f36df0613e39c9e4f0d579f170d0e29a2de789bd9c72c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SMYY.exe
        • Path C:\Windows\SMYY.exe
        • Size 1.6MB
        • SHA256 1a713a392e9545bbe378ba4475dd74c9daae8f523252c82bb84f9df5b743677a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SosQ.exe
        • Path C:\Windows\SosQ.exe
        • Size 2.2MB
        • SHA256 dedb739470eda72cfe0d850c64a621f963acda0a57fdd068f6e7b46bdfa82d30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Ssoc.ico
        • Path C:\Windows\Ssoc.ico
        • Size 4KB
        • SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SwAU.exe
        • Path C:\Windows\SwAU.exe
        • Size 1.6MB
        • SHA256 825cecb9d5a1123387f78790a93b16a30e67705120ff57c5d5d1dfb5cce4c6ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SwQG.exe
        • Path C:\Windows\SwQG.exe
        • Size 3.1MB
        • SHA256 be3600f3abf016460194f9636bc295e649f29dd044fd505d60bd7e29803cb4af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UAYO.exe
        • Path C:\Windows\UAYO.exe
        • Size 1.8MB
        • SHA256 2dd8583f4a32788d55f82fb3f8f5901d3db641a9e2f405e1f992124c139755d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UQcy.exe
        • Path C:\Windows\UQcy.exe
        • Size 1.9MB
        • SHA256 54ba52e9a5d77df264d25fd30bf360a9c9bb6be29d4784635311bd935e974421
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UYII.exe
        • Path C:\Windows\UYII.exe
        • Size 2.3MB
        • SHA256 ec36f8867d1c3dfe2ffbf19b736f7940c039bbc75959b53b164e93bcd54654a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Ucsc.exe
        • Path C:\Windows\Ucsc.exe
        • Size 1.6MB
        • SHA256 bdb8b09a824c9391c5bcd5f6b119cfacf80afe2f4fb9b0fbc748caf5d8891b94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UgMu.exe
        • Path C:\Windows\UgMu.exe
        • Size 1.8MB
        • SHA256 72233700993133c1e818ab573198836f5d6c85b3b7f9e00e312adc11346ae949
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UgoU.exe
        • Path C:\Windows\UgoU.exe
        • Size 1.7MB
        • SHA256 b02821a8bc4938f11282f7e6dc037ef6197f02389c3e45c333a0897c5ad3735f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UoQW.exe
        • Path C:\Windows\UoQW.exe
        • Size 1.8MB
        • SHA256 b07385e19341bf1e0762def2533c223505d586779abf2da8216c9b2042e882ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Usws.exe
        • Path C:\Windows\Usws.exe
        • Size 1.7MB
        • SHA256 b3b8f82c4e9655a578f93ef9535f6695930f2d9e6b7fffae322e6e04549d41d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WAMI.exe
        • Path C:\Windows\WAMI.exe
        • Size 2.2MB
        • SHA256 f59a7f73981b00aa30bbaabbcdb4e6b0680b988000e6797737ff05e6d26cb177
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WIwW.exe
        • Path C:\Windows\WIwW.exe
        • Size 1.7MB
        • SHA256 cb885e2fe41ba23672d7dc664818deae44c1e254a02295eef7217c1d35542b9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WIwi.exe
        • Path C:\Windows\WIwi.exe
        • Size 1.7MB
        • SHA256 f9842a5c75a41829c343183214129ab04cd3a3e766f063f4cef380d33bf5dba3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WMgc.exe
        • Path C:\Windows\WMgc.exe
        • Size 2.2MB
        • SHA256 a56f292b6a8eca90d488a3d65afc11810cb85d14cf4e09644768cb39ba23505f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WQIC.exe
        • Path C:\Windows\WQIC.exe
        • Size 2.3MB
        • SHA256 828b34ee4a39ddf0311477625508c5c2073b2b5ac93accf08434dee70b3e5c3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Wggo.exe
        • Path C:\Windows\Wggo.exe
        • Size 1.6MB
        • SHA256 77b1d47c9be9a4007c0ff346ba0f340d903ff84e99b075c11c9a3ed98fc0753a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WwAK.exe
        • Path C:\Windows\WwAK.exe
        • Size 1.6MB
        • SHA256 5035338cd4d303fa4d0014ed475390a6f269db136d05b82bc2a4a57098689088
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        YAgQ.exe
        • Path C:\Windows\YAgQ.exe
        • Size 1.7MB
        • SHA256 4153f4368b91d7430b7184b0183803e854ea084af4b53404eb1faa2f23a848d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        YMgI.exe
        • Path C:\Windows\YMgI.exe
        • Size 1.8MB
        • SHA256 84b25d697282717e4a53226e1b93199eae0fa9c762a4a25f6980be0fe444bb23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        YMsA.exe
        • Path C:\Windows\YMsA.exe
        • Size 1.6MB
        • SHA256 50707ccf5f8f8a638eafb1b5aafb6d57bdbc2a2dd76e843d7da28aeecb1e6649
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        YMsI.exe
        • Path C:\Windows\YMsI.exe
        • Size 1.6MB
        • SHA256 a980cef4f95147e9f8b6706def4e218a58a47f1ab29d9bccf182e1261022773a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Ykwu.exe
        • Path C:\Windows\Ykwu.exe
        • Size 1.6MB
        • SHA256 80d3d8004d07554fda4f8e9b975eeb4b40f96524d1eaad90089dfeba95a341ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        YwgS.exe
        • Path C:\Windows\YwgS.exe
        • Size 1.8MB
        • SHA256 5f089ad04740a6957ac89939605b7ef5fcf4cb54f140469f9e6e8b0535ee1b54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        aAAQ.exe
        • Path C:\Windows\aAAQ.exe
        • Size 1.7MB
        • SHA256 03029971442cbbc547069e8f431f96d41150bf74ef2ad5a78621776c96fd1bea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        aMko.exe
        • Path C:\Windows\aMko.exe
        • Size 2.0MB
        • SHA256 4a363e0d84ce1a55e1b650f4166281fbd437825b74060dd160a64869c7515349
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        aQEy.exe
        • Path C:\Windows\aQEy.exe
        • Size 3.1MB
        • SHA256 cc26e97fafa3b6cc8fda70bdcbaa3a4a86ee08261e06bb63a2fc01ad5560c9c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        aYIq.exe
        • Path C:\Windows\aYIq.exe
        • Size 1.6MB
        • SHA256 3b45277a8a2acbad1ccc3df6bae2c1545e032874d675b5b9d15daa26951a9c71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        aggM.exe
        • Path C:\Windows\aggM.exe
        • Size 1.6MB
        • SHA256 a35c6cd3e791192b52e227ab693d724e29d28d7c6d0be1cd2e66789d625ed7fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        asEY.exe
        • Path C:\Windows\asEY.exe
        • Size 1.7MB
        • SHA256 f30cff1687c2561885324fe1651247ecd76e3002d7ff554fbec721d63b71fca4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cQQq.exe
        • Path C:\Windows\cQQq.exe
        • Size 1.7MB
        • SHA256 4e8f9a234ddfbbb70af1719d91847e5c673e870341474e972110d407e43b68d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cYcY.exe
        • Path C:\Windows\cYcY.exe
        • Size 1.6MB
        • SHA256 e045048f2798b6ba0134c5bc2ee7beb7de6d8150694f6beb9a3cc5dbca859299
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cYks.exe
        • Path C:\Windows\cYks.exe
        • Size 1.7MB
        • SHA256 c354953095e55d5c473ab67a5a8aa1eb2b1c2ee394b364fb5a35953253f5de39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        eEcm.exe
        • Path C:\Windows\eEcm.exe
        • Size 1.6MB
        • SHA256 9cb302852214ac7fc438a903e1bd2ac051af73065b16fecd76975c22d46686d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        eEcm.exe
        • Path C:\Windows\eEcm.exe
        • Size 1.6MB
        • SHA256 16aef309774265e3b1e74ddfbc8a338a85fff8a82c83ffa81a6e429166243cd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        eGMQ.ico
        • Path C:\Windows\eGMQ.ico
        • Size 4KB
        • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        eggk.exe
        • Path C:\Windows\eggk.exe
        • Size 1.7MB
        • SHA256 f0629588beba02896b038bc4b23e9f420dc504c66f2b14517a2ff2c06a8be85a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        eogQ.exe
        • Path C:\Windows\eogQ.exe
        • Size 1.7MB
        • SHA256 1c09c4813f3cc0e0d48014bee18ab28a378afc8309afc1ba264096a292fe8e63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        gAQO.exe
        • Path C:\Windows\gAQO.exe
        • Size 1.6MB
        • SHA256 c5815264a5eb361c8baf163a1050f9f6475ade4bd2b11165031cb6527724422a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        gAsC.exe
        • Path C:\Windows\gAsC.exe
        • Size 2.1MB
        • SHA256 d8b5f8da0a34e2a197f1adf7e43fb42b97e0fc3552f2c39556315718d1a09d18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        gEkU.exe
        • Path C:\Windows\gEkU.exe
        • Size 2.9MB
        • SHA256 ee42568ae8b5d6b331142a040c201bbf2048b798937c615a0980ab5ae32192af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        gMEs.exe
        • Path C:\Windows\gMEs.exe
        • Size 2.1MB
        • SHA256 b068218291e2be0acecb154863e8d451c99f4081bde91a86d6ff0b9a2b71e63b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ggcQ.exe
        • Path C:\Windows\ggcQ.exe
        • Size 2.2MB
        • SHA256 2024dc2b32e5f1cb50f8a0f6d69bbb09b38f88bd16eddee4f98aa30835fa1e0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        iIcA.exe
        • Path C:\Windows\iIcA.exe
        • Size 2.2MB
        • SHA256 051c6e6b5f437d96a591dc5ee502f9d49f37cd71caf0524870f39a5924fe6573
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        iQku.exe
        • Path C:\Windows\iQku.exe
        • Size 1.6MB
        • SHA256 08edf1312d769643e452e9ef64735dd313f3fe787fe387f82755b7e3a6fdf229
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        iYMy.exe
        • Path C:\Windows\iYMy.exe
        • Size 1.7MB
        • SHA256 0b5c87e50ad50532de8bea342e8deec2cdcf721f49f56600163294f8924d6c15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ioEa.exe
        • Path C:\Windows\ioEa.exe
        • Size 1.6MB
        • SHA256 9d373f7ab0310d362214a8a41677f38d480c42c73da5d51579a3b5ca2dc3b4ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        iowe.exe
        • Path C:\Windows\iowe.exe
        • Size 1.8MB
        • SHA256 854657a5b9ccf4762cec7a77e581a399ce8af12c7d070593bebdbe30d4d97d4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kAIi.exe
        • Path C:\Windows\kAIi.exe
        • Size 1.8MB
        • SHA256 3aaa783d91972b732b574f301c75fa26eaa6a8410e7902043474a1d039a5abd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kMko.exe
        • Path C:\Windows\kMko.exe
        • Size 1.9MB
        • SHA256 a75e992bed47760dc08fc0eebdad1e4a383d0901296f77b4397153500d42f2f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kQwK.exe
        • Path C:\Windows\kQwK.exe
        • Size 2.3MB
        • SHA256 7d9758dd97f932cfdc26920c3ea370140dcf988923767d3aa07336f688d0ec6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kYEw.exe
        • Path C:\Windows\kYEw.exe
        • Size 1.8MB
        • SHA256 4e5168b7fbd70724d3f696769a805c226b02163f2c506f8722364e14c2226710
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kcIC.exe
        • Path C:\Windows\kcIC.exe
        • Size 1.7MB
        • SHA256 35b029518200d286b99511063fc850f1f13bc023b1ad6896d8ea945691bb5812
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kcwy.exe
        • Path C:\Windows\kcwy.exe
        • Size 1.6MB
        • SHA256 849c860949ededfc9e0ac17767958783f6ab8ef9150838f8f9695bb072d10f53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kgQk.exe
        • Path C:\Windows\kgQk.exe
        • Size 1.6MB
        • SHA256 c769db376d059a889eb9cbc53e33f225c8f324892ac49a462582610659a35557
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kggw.exe
        • Path C:\Windows\kggw.exe
        • Size 2.1MB
        • SHA256 b4e621e762eac6337f7a1fbd5b328e3d3c2dfbe2022fd4a6872a86373168bc95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kwUk.exe
        • Path C:\Windows\kwUk.exe
        • Size 2.5MB
        • SHA256 4c4a6732f789fcf1a1bd05146e1c3f2fffc936a2b93066ac6e3919f3a87b1ab1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kwsK.exe
        • Path C:\Windows\kwsK.exe
        • Size 1.6MB
        • SHA256 65b00b8873b69f75fb83f6f11db6192e539e00fe7c282d1f8e775cbf1e4c773c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mEQY.exe
        • Path C:\Windows\mEQY.exe
        • Size 1.7MB
        • SHA256 ae0a7d080c6b476fa5656e64a12ccabed50d5aee5b784493ab7da643ac7c9ae2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mMUw.exe
        • Path C:\Windows\mMUw.exe
        • Size 1.7MB
        • SHA256 e8dc81b5f0e941109ea899a8bb5589c8afd7a541fd22fba8e11e0bdc36c0030e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        oAEC.exe
        • Path C:\Windows\oAEC.exe
        • Size 1.6MB
        • SHA256 65a90cbdcffc38d7965fef2885ae073afc7185d94e4414ec558531ad1929e9bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        oIMm.exe
        • Path C:\Windows\oIMm.exe
        • Size 2.0MB
        • SHA256 2890aa59aac44aeb0b6884174a4387ecb903f99e35c8249663e8f2a8c7baca16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        oIws.exe
        • Path C:\Windows\oIws.exe
        • Size 2.1MB
        • SHA256 5f760dd1d42b25b03d75a45bdb7dcd91150768a075905d0172153ef530ea29dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        oOwo.ico
        • Path C:\Windows\oOwo.ico
        • Size 4KB
        • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        oUQs.exe
        • Path C:\Windows\oUQs.exe
        • Size 2.0MB
        • SHA256 8cb6f721a06f09e21b0928f2c4c18c583db1fb51c52a7650cad019a8602e952f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        oYAE.exe
        • Path C:\Windows\oYAE.exe
        • Size 1.6MB
        • SHA256 9492ebb558f016c9cc7565605f27391c176a11652e1578444ee2048b541ab30d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ocso.exe
        • Path C:\Windows\ocso.exe
        • Size 1.6MB
        • SHA256 5cb522b10cc57a89924b10a2ceb56c9530b312d25999c6823b8ddc2b1cea211d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        okcm.exe
        • Path C:\Windows\okcm.exe
        • Size 2.1MB
        • SHA256 b5ed7485ea10648c8776f4330a2c11a4f4ca56cace14e7df80d66561b2891554
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        oose.exe
        • Path C:\Windows\oose.exe
        • Size 1.9MB
        • SHA256 75b9ada07af13bd21728b59973ea4f33d6430d5e2d00fb2f0afc695d3c843751
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qMIQ.exe
        • Path C:\Windows\qMIQ.exe
        • Size 2.2MB
        • SHA256 45561cc12a89092a06ec9629a82f4bb2c17eb72986dcc3c5f24de1087cb7df3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qUAU.exe
        • Path C:\Windows\qUAU.exe
        • Size 1.7MB
        • SHA256 7904d9c719849fda4de31eb596bed79a0945eb4df584995669b299d6438ea413
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qYgO.exe
        • Path C:\Windows\qYgO.exe
        • Size 1.6MB
        • SHA256 93cae5066fbb8c4325d840cbb4be59ba99fafa7d11c537aeba9d3afb7096e074
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qgMQ.exe
        • Path C:\Windows\qgMQ.exe
        • Size 1.8MB
        • SHA256 3e64e8d07047dc6bb6667c5f2e85414c46fc2aa328780071b2ba66c7085b7651
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qsEQ.exe
        • Path C:\Windows\qsEQ.exe
        • Size 2.0MB
        • SHA256 9399a7b91300d73cf9713bd05a067727097a5b5b17f80bd44a3e61c8b596ae58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qsku.exe
        • Path C:\Windows\qsku.exe
        • Size 1.9MB
        • SHA256 1cf4318bc993a39f5d5b23631489b17cc17421fc280a5ed4bae00227ccf40277
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qwQK.exe
        • Path C:\Windows\qwQK.exe
        • Size 1.8MB
        • SHA256 96542e915e7fdf40f95d30264d6d822ba623bb3f137a87a02c1f1f4f413a63d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qwsM.exe
        • Path C:\Windows\qwsM.exe
        • Size 2.0MB
        • SHA256 45ea5890d38b2d64710b8aaf0db0f79e9c756cd10ae3f3c5c7597c1552cba6ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sAIu.exe
        • Path C:\Windows\sAIu.exe
        • Size 2.1MB
        • SHA256 3fa774af60d79dd846efaacab9316a9fd4762efc0e4eaf7fffd37085b2be07fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sEAK.exe
        • Path C:\Windows\sEAK.exe
        • Size 2.7MB
        • SHA256 9b2037fa68998c6974da03980f30864d8c62e61c60c8a4bdce95eaa87b9027be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sEUy.exe
        • Path C:\Windows\sEUy.exe
        • Size 1.8MB
        • SHA256 a665f949ac72856246c2a6c0908dcac5089140150b0728a63eaaad3c200b5a51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scsk.exe
        • Path C:\Windows\scsk.exe
        • Size 2.0MB
        • SHA256 944dde11acf33ee7b74edc795753c3369f0a5b26f903c9e062a4cc821be0674a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        siYs.ico
        • Path C:\Windows\siYs.ico
        • Size 4KB
        • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        skMs.exe
        • Path C:\Windows\skMs.exe
        • Size 1.6MB
        • SHA256 c78c6d5c237874763e191908dad25e841bd1330aa0de892adace016b10ac8bd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        swUY.exe
        • Path C:\Windows\swUY.exe
        • Size 2.1MB
        • SHA256 24afb8d609df3a5990bc4055a58216b32a84a7c17dcc9d01d6c122140916849e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        swkQ.exe
        • Path C:\Windows\swkQ.exe
        • Size 1.8MB
        • SHA256 fdd6a603cee9cc83982615611518b1e5ccb4b39d5532035c0a90f12cde9a3d49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uEoM.exe
        • Path C:\Windows\uEoM.exe
        • Size 2.0MB
        • SHA256 4a5301fa2b2464c01187e55474e8a16dc011c65f1107cc55723cb1c004f8e2e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uIUi.exe
        • Path C:\Windows\uIUi.exe
        • Size 2.4MB
        • SHA256 27b41cdd33187a73ba12d991ee029fa603bd6e575695841b23e44b254a495218
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uMko.exe
        • Path C:\Windows\uMko.exe
        • Size 1.8MB
        • SHA256 e9d8ad2a5e367c6bbc69ea44f677c19ab09cc4226fab42562a63d3a50c1aaffd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uQgI.exe
        • Path C:\Windows\uQgI.exe
        • Size 2.4MB
        • SHA256 2e074b40c4857d3be47d65cc86c726014045aa4b7eb49a8cf495e0cfa44815db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uYwy.exe
        • Path C:\Windows\uYwy.exe
        • Size 1.8MB
        • SHA256 67044af6925ffd873f9f0ea5570c180c07f4b2f0434c2b3d30c6e4e02dd86359
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ucgq.exe
        • Path C:\Windows\ucgq.exe
        • Size 2.4MB
        • SHA256 c6664965d0fe1209ac38c6855683741395f7f5b554b1bf0e4a8492c7bd4a42b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ukMk.ico
        • Path C:\Windows\ukMk.ico
        • Size 4KB
        • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ukMs.ico
        • Path C:\Windows\ukMs.ico
        • Size 4KB
        • SHA256 5963420fd9ba8c8248e3f50d179dfa21caca8538ad1482a03f260b27cf218043
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uokc.exe
        • Path C:\Windows\uokc.exe
        • Size 1.7MB
        • SHA256 ac1cbd5b82eabede87ac78d923fdea7aade3179b4afcddca779707b8271c5d58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        usIk.exe
        • Path C:\Windows\usIk.exe
        • Size 1.8MB
        • SHA256 6803d5351b3c0538866e64183aed3dfd3204735b1b88ed1375d7899ec4ef6274
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uwIc.exe
        • Path C:\Windows\uwIc.exe
        • Size 1.6MB
        • SHA256 3914d4717dd76baa4dfac4b9178f16ca7eb798e17d2144fc1e94b2c2a19a6535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wEsk.exe
        • Path C:\Windows\wEsk.exe
        • Size 2.5MB
        • SHA256 5b0a6a10a0208fb8defb5fc8ebc292875612b458cea7ec043577a5dbc16e8028
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wIEI.exe
        • Path C:\Windows\wIEI.exe
        • Size 2.3MB
        • SHA256 f2760be40aff7cae3b366e9bf03221056971f11038da8de9fb9c833b7acca230
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wUsg.exe
        • Path C:\Windows\wUsg.exe
        • Size 1.6MB
        • SHA256 71ee39a08cd8dae4d34913a77b01c1ba4050ed7665185317c5aad44bd88943a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wcww.exe
        • Path C:\Windows\wcww.exe
        • Size 1.8MB
        • SHA256 2fe2680f0840a9e7ce03318aff88b1df1b2665852b399613d72105abd9e6d30d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wgIy.exe
        • Path C:\Windows\wgIy.exe
        • Size 1.8MB
        • SHA256 288358f0f9b1b6e43467470997d36aec77e2a6f6e7387e84d4e278575c8ca11a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wiwY.ico
        • Path C:\Windows\wiwY.ico
        • Size 4KB
        • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        yMMY.exe
        • Path C:\Windows\yMMY.exe
        • Size 1.6MB
        • SHA256 93c7ab7c010688f2096c5549dfedfcf455f0564a10e579c65d6bcf4d10ba49c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        yQMO.exe
        • Path C:\Windows\yQMO.exe
        • Size 1.7MB
        • SHA256 db2825ae599c39e9f3a9b52f18393ff5cae9d9eb2ee17a7bc6df2a7c23c89388
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        yUEo.exe
        • Path C:\Windows\yUEo.exe
        • Size 2.7MB
        • SHA256 0fbc6c1e05cd05081e73dc9686af7c1b0fc21f7f760068301fa2f385997c4930
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ywsC.exe
        • Path C:\Windows\ywsC.exe
        • Size 1.7MB
        • SHA256 9b6fb6112a9ba2aaeab19619124fce603028ef528ad53cb6c1596d63c93fb674
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1648-18-0x0000000000400000-0x0000000000590000-memory.dmp
        Download

        memory/1648-2080-0x0000000000400000-0x0000000000590000-memory.dmp
        Download

        memory/2344-71-0x0000000000400000-0x0000000000592000-memory.dmp
        Download

        memory/2612-55-0x0000000000400000-0x0000000000592000-memory.dmp
        Download

        memory/2808-99-0x0000000000400000-0x0000000000592000-memory.dmp
        Download

        memory/2940-85-0x0000000000400000-0x0000000000592000-memory.dmp
        Download

        memory/3124-2075-0x0000000000400000-0x000000000058F000-memory.dmp
        Download

        memory/3492-2090-0x0000000000400000-0x0000000000590000-memory.dmp
        Download

        memory/3904-23-0x0000000000400000-0x0000000000591000-memory.dmp
        Download

        memory/3904-2085-0x0000000000400000-0x0000000000591000-memory.dmp
        Download

        memory/4120-143-0x0000000000400000-0x0000000000592000-memory.dmp
        Download

        memory/4144-0-0x0000000000400000-0x0000000000592000-memory.dmp
        Download

        memory/4144-39-0x0000000000850000-0x0000000000870000-memory.dmp
        Download

        memory/4144-38-0x0000000000400000-0x0000000000592000-memory.dmp
        Download

        memory/4144-1-0x0000000000850000-0x0000000000870000-memory.dmp
        Download

        memory/4452-112-0x0000000000400000-0x0000000000592000-memory.dmp
        Download

        memory/4772-7-0x0000000000400000-0x000000000058F000-memory.dmp
        Download

        memory/4772-2070-0x0000000000400000-0x000000000058F000-memory.dmp
        Download

        memory/5784-127-0x0000000000400000-0x0000000000592000-memory.dmp
        Download