nabucur | 5986747bdd659376d84354619c8a0bb66c2dc8d1f079dd9659e7c986b8b76eca

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
Size 1.6MB
Sample260808-bd7wdsztht
SHA256 5986747bdd659376d84354619c8a0bb66c2dc8d1f079dd9659e7c986b8b76eca
MD5 8310dfdb1219cfef7140adcd3187ab80
SHA1 7c0b2083a5bff878b5b19234395d250b78e7cb71
SHA512 b61232b481a9415539fe4022aef1f0da797fc6f69c73e201dd7cc04093adeaca97fbee7dbad6e9f574c8fde4e7b57f1afd7e4ef9f925bdda7bdfc4b431fde241
SSDEEP 12288:RksM1igTsaBx9Z+0oNjcN2p9GTy6rHjC2d/F6DiJiKi1DFM:SJBxb+R5cNYYy6rHpdduioxFM
TLSH
T1957575516187BD59DAC4C3BE6D90562EBD61F9C2C00B4C26B80B9B53B1EEC4A80F479F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution nabucur persistence ransomware spyware stealer trojan

Malware Config

Signatures

Family: Nabucur
Nabucur is a ransomware first seen in 2015.
ransomware nabucur

Modifies visibility of file extensions in Explorer 2 TTPs 17 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe

UAC bypass 3 TTPs 17 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Renames multiple (86) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 5 IoCs

pid	Process
2692	eUcQEAoQ.exe
5464	OOoMsEgE.exe
4880	PSoQskws.exe
4340	OOoMsEgE.exe
4776	eUcQEAoQ.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OOoMsEgE.exe = "C:\\ProgramData\\VwQUAggE\\OOoMsEgE.exe"	OOoMsEgE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\eUcQEAoQ.exe = "C:\\Users\\Admin\\hGUgoMkE\\eUcQEAoQ.exe"	eUcQEAoQ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\eUcQEAoQ.exe = "C:\\Users\\Admin\\hGUgoMkE\\eUcQEAoQ.exe"	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OOoMsEgE.exe = "C:\\ProgramData\\VwQUAggE\\OOoMsEgE.exe"	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\eUcQEAoQ.exe = "C:\\Users\\Admin\\hGUgoMkE\\eUcQEAoQ.exe"	eUcQEAoQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OOoMsEgE.exe = "C:\\ProgramData\\VwQUAggE\\OOoMsEgE.exe"	OOoMsEgE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OOoMsEgE.exe = "C:\\ProgramData\\VwQUAggE\\OOoMsEgE.exe"	PSoQskws.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\hGUgoMkE	PSoQskws.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\hGUgoMkE\eUcQEAoQ	PSoQskws.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 17 IoCs

execution

Visual Basic

T1059.005

pid	Process
2764	cscript.exe
3968	cscript.exe
1916	cscript.exe
1692	cscript.exe
616	cscript.exe
2020	cscript.exe
2024	cscript.exe
1500	cscript.exe
4312	cscript.exe
5688	cscript.exe
5672	cscript.exe
3628	cscript.exe
4744	cscript.exe
3900	cscript.exe
3908	cscript.exe
4444	cscript.exe
2328	cscript.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\scgU.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\gYYg.exe	OOoMsEgE.exe
File created	C:\Windows\osIM.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\mUMG.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\YcEq.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\ckkE.exe	OOoMsEgE.exe
File created	C:\Windows\EUUe.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\GAco.ico	OOoMsEgE.exe
File opened for modification	C:\Windows\OuYE.ico	OOoMsEgE.exe
File created	C:\Windows\YkQe.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\CYQQ.exe	OOoMsEgE.exe
File created	C:\Windows\cMIy.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\qgcg.exe	OOoMsEgE.exe
File created	C:\Windows\kMQW.exe	OOoMsEgE.exe
File created	C:\Windows\CYQQ.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\ICoI.ico	OOoMsEgE.exe
File opened for modification	C:\Windows\GeIo.ico	OOoMsEgE.exe
File opened for modification	C:\Windows\GAgG.exe	OOoMsEgE.exe
File created	C:\Windows\mcQY.exe	OOoMsEgE.exe
File created	C:\Windows\cEAK.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\cEAK.exe	OOoMsEgE.exe
File created	C:\Windows\kIIs.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\IUck.ico	OOoMsEgE.exe
File opened for modification	C:\Windows\CYQW.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\WUAw.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\IMMM.ico	OOoMsEgE.exe
File opened for modification	C:\Windows\MMQY.ico	OOoMsEgE.exe
File opened for modification	C:\Windows\kMww.exe	OOoMsEgE.exe
File created	C:\Windows\mAMY.exe	OOoMsEgE.exe
File created	C:\Windows\SEke.exe	OOoMsEgE.exe
File created	C:\Windows\uoQi.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\mwMs.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\KYIu.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\MoQs.exe	OOoMsEgE.exe
File created	C:\Windows\cQYQ.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\gsQq.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\KwAU.ico	OOoMsEgE.exe
File opened for modification	C:\Windows\oYYI.ico	OOoMsEgE.exe
File opened for modification	C:\Windows\gYgK.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\moMS.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\oAcE.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\sqUc.ico	OOoMsEgE.exe
File opened for modification	C:\Windows\iUYk.ico	OOoMsEgE.exe
File opened for modification	C:\Windows\MOUg.ico	OOoMsEgE.exe
File opened for modification	C:\Windows\SIwM.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\cUws.exe	OOoMsEgE.exe
File created	C:\Windows\YIIu.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\USwU.ico	OOoMsEgE.exe
File opened for modification	C:\Windows\kMsI.exe	OOoMsEgE.exe
File created	C:\Windows\eQMA.exe	OOoMsEgE.exe
File created	C:\Windows\Skke.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\KqsU.ico	OOoMsEgE.exe
File created	C:\Windows\CkcI.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\GkMc.exe	OOoMsEgE.exe
File created	C:\Windows\icIC.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\uogI.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\iQwa.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\iegU.ico	OOoMsEgE.exe
File created	C:\Windows\moMS.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\AuAA.ico	OOoMsEgE.exe
File opened for modification	C:\Windows\mcQY.exe	OOoMsEgE.exe
File created	C:\Windows\yUsE.exe	OOoMsEgE.exe
File opened for modification	C:\Windows\CYsY.ico	OOoMsEgE.exe
File opened for modification	C:\Windows\YwIq.exe	OOoMsEgE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 34 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2356	cmd.exe
4884	cmd.exe
5104	cmd.exe
2600	cmd.exe
4956	cmd.exe
5556	cmd.exe
5800	cmd.exe
5780	cmd.exe
3888	cmd.exe
3724	cmd.exe
2160	cmd.exe
3420	cmd.exe
3424	cmd.exe
4524	cmd.exe
3872	cmd.exe
2152	cmd.exe
5888	cmd.exe
4464	cmd.exe
3328	cmd.exe
5932	cmd.exe
4564	cmd.exe
2640	cmd.exe
4132	cmd.exe
2268	cmd.exe
1700	cmd.exe
3392	cmd.exe
2928	cmd.exe
1676	cmd.exe
4264	cmd.exe
3044	cmd.exe
5716	cmd.exe
6024	cmd.exe
5296	cmd.exe
4456	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eUcQEAoQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OOoMsEgE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry key 1 TTPs 51 IoCs

Modify Registry

T1112

pid	Process
1420	reg.exe
5836	reg.exe
3476	reg.exe
5864	reg.exe
356	reg.exe
3704	reg.exe
4192	reg.exe
1224	reg.exe
1644	reg.exe
1120	reg.exe
1888	reg.exe
2108	reg.exe
5148	reg.exe
2332	reg.exe
3524	reg.exe
6092	reg.exe
2768	reg.exe
3408	reg.exe
1632	reg.exe
4144	reg.exe
5560	reg.exe
3316	reg.exe
1256	reg.exe
4892	reg.exe
2376	reg.exe
2620	reg.exe
3504	reg.exe
1600	reg.exe
5216	reg.exe
2348	reg.exe
5140	reg.exe
1768	reg.exe
3420	reg.exe
5488	reg.exe
2996	reg.exe
3020	reg.exe
5980	reg.exe
5920	reg.exe
4756	reg.exe
4228	reg.exe
3992	reg.exe
5876	reg.exe
3956	reg.exe
4540	reg.exe
696	reg.exe
1208	reg.exe
5568	reg.exe
3604	reg.exe
4520	reg.exe
4700	reg.exe
5360	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3436	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
3436	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
3436	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
3436	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
2500	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
2500	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
2500	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
2500	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
3352	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
3352	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
3352	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
3352	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
2632	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
2632	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
2632	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
2632	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
1068	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
1068	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
1068	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
1068	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
2792	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
2792	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
2792	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
2792	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
4940	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
4940	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
4940	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
4940	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
6000	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
6000	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
6000	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
6000	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
4576	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
4576	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
4576	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
4576	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
2584	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
2584	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
2584	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
2584	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
1436	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
1436	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
1436	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
1436	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
892	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
892	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
892	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
892	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
4140	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
4140	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
4140	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
4140	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
3444	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
3444	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
3444	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
3444	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
4160	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
4160	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
4160	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
4160	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
2976	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
2976	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
2976	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
2976	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
4340	OOoMsEgE.exe
4340	OOoMsEgE.exe
4340	OOoMsEgE.exe
4340	OOoMsEgE.exe
4340	OOoMsEgE.exe
4340	OOoMsEgE.exe
4340	OOoMsEgE.exe
4340	OOoMsEgE.exe
4340	OOoMsEgE.exe
4340	OOoMsEgE.exe
4340	OOoMsEgE.exe
4340	OOoMsEgE.exe
4340	OOoMsEgE.exe
4340	OOoMsEgE.exe
4340	OOoMsEgE.exe
4340	OOoMsEgE.exe
4340	OOoMsEgE.exe
4340	OOoMsEgE.exe
4340	OOoMsEgE.exe
4340	OOoMsEgE.exe
4340	OOoMsEgE.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 2692	3436	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	89
PID 3436 wrote to memory of 5464	3436	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	90
PID 3436 wrote to memory of 6024	3436	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	95
PID 6024 wrote to memory of 2500	6024	cmd.exe	97
PID 3436 wrote to memory of 1888	3436	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	99
PID 3436 wrote to memory of 6092	3436	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	100
PID 3436 wrote to memory of 5140	3436	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	101
PID 3436 wrote to memory of 2600	3436	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	102
PID 2500 wrote to memory of 1700	2500	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	108
PID 2500 wrote to memory of 5876	2500	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	110
PID 2500 wrote to memory of 1768	2500	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	111
PID 2500 wrote to memory of 4520	2500	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	112
PID 2500 wrote to memory of 4956	2500	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	113
PID 1700 wrote to memory of 3352	1700	cmd.exe	118
PID 3352 wrote to memory of 2928	3352	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	119
PID 3352 wrote to memory of 3408	3352	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	121
PID 3352 wrote to memory of 2768	3352	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	122
PID 3352 wrote to memory of 4700	3352	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	123
PID 3352 wrote to memory of 5932	3352	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	124
PID 4956 wrote to memory of 1916	4956	cmd.exe	129
PID 2928 wrote to memory of 2632	2928	cmd.exe	130
PID 5932 wrote to memory of 3900	5932	cmd.exe	131
PID 2600 wrote to memory of 3908	2600	cmd.exe	132
PID 2632 wrote to memory of 3392	2632	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	133
PID 3392 wrote to memory of 1068	3392	cmd.exe	135
PID 2632 wrote to memory of 2996	2632	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	136
PID 2632 wrote to memory of 5360	2632	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	286
PID 2632 wrote to memory of 3020	2632	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	283
PID 2632 wrote to memory of 3872	2632	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	139
PID 3872 wrote to memory of 2024	3872	cmd.exe	144
PID 1068 wrote to memory of 2152	1068	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	145
PID 2152 wrote to memory of 2792	2152	cmd.exe	147
PID 1068 wrote to memory of 2108	1068	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	148
PID 1068 wrote to memory of 3704	1068	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	149
PID 1068 wrote to memory of 1632	1068	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	150
PID 1068 wrote to memory of 3724	1068	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	151
PID 3724 wrote to memory of 4444	3724	cmd.exe	156
PID 2792 wrote to memory of 5888	2792	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	157
PID 2792 wrote to memory of 3956	2792	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	159
PID 2792 wrote to memory of 1420	2792	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	160
PID 2792 wrote to memory of 4540	2792	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	235
PID 2792 wrote to memory of 4564	2792	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	162
PID 5888 wrote to memory of 4940	5888	cmd.exe	167
PID 4564 wrote to memory of 1500	4564	cmd.exe	168
PID 4940 wrote to memory of 4464	4940	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	169
PID 4464 wrote to memory of 6000	4464	cmd.exe	171
PID 4940 wrote to memory of 696	4940	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	172
PID 4940 wrote to memory of 1256	4940	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	173
PID 4940 wrote to memory of 4192	4940	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	174
PID 4940 wrote to memory of 5104	4940	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	175
PID 6000 wrote to memory of 2640	6000	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	180
PID 6000 wrote to memory of 5148	6000	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	182
PID 6000 wrote to memory of 3420	6000	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	259
PID 6000 wrote to memory of 3992	6000	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	184
PID 6000 wrote to memory of 2160	6000	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	185
PID 5104 wrote to memory of 4312	5104	cmd.exe	190
PID 2640 wrote to memory of 4576	2640	cmd.exe	191
PID 2160 wrote to memory of 5688	2160	cmd.exe	192
PID 4576 wrote to memory of 5556	4576	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	193
PID 5556 wrote to memory of 2584	5556	cmd.exe	195
PID 4576 wrote to memory of 5836	4576	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	196
PID 4576 wrote to memory of 5980	4576	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	197
PID 4576 wrote to memory of 1224	4576	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	198
PID 4576 wrote to memory of 1676	4576	2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe	199

C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Users\Admin\hGUgoMkE\eUcQEAoQ.exe
  "C:\Users\Admin\hGUgoMkE\eUcQEAoQ.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2692
- C:\ProgramData\VwQUAggE\OOoMsEgE.exe
  "C:\ProgramData\VwQUAggE\OOoMsEgE.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6024
- - C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3352
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock"
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock"
        10⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock
        11⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock"
        12⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock
        13⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock"
        14⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock
        15⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:6000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock"
        16⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock
        17⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock"
        18⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock
        19⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock"
        20⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock
        21⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock"
        22⤵
        Executes a command shell one-liner
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock
        23⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock"
        24⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock
        25⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock"
        26⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock
        27⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock"
        28⤵
        Executes a command shell one-liner
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock
        29⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock"
        30⤵
        Executes a command shell one-liner
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock
        31⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock"
        32⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock
        33⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock"
        34⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4884
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        34⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:2348
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        34⤵
        Modifies registry key
        
        PID:1120
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        34⤵
        UAC bypass
        Modifies registry key
        
        PID:356
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        35⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fsogkgEo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe""
        34⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2268
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        35⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:4744
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        32⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:3604
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        33⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        32⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5216
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        32⤵
        UAC bypass
        Modifies registry key
        
        PID:5488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OiAwQoAw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe""
        32⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3424
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        33⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        33⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:3968
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        30⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:5864
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        30⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1600
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        30⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CaoQAMgk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe""
        30⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2356
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        31⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:2764
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        28⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:2376
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        28⤵
        Modifies registry key
        
        PID:2620
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        28⤵
        UAC bypass
        Modifies registry key
        
        PID:3476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GYAgMEkw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe""
        28⤵
        Executes a command shell one-liner
        
        PID:3420
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        29⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:3628
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        26⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:5560
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        26⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5568
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        26⤵
        UAC bypass
        Modifies registry key
        
        PID:3316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UmMAwsEU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe""
        26⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3888
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        27⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:2020
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        24⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4228
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        25⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        24⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1208
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        24⤵
        UAC bypass
        Modifies registry key
        
        PID:4756
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XOMowkkQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe""
        24⤵
        Executes a command shell one-liner
        
        PID:5780
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        25⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:616
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        22⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1644
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        22⤵
        Modifies registry key
        
        PID:4892
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        22⤵
        UAC bypass
        Modifies registry key
        
        PID:4144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TkoAwkIg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe""
        22⤵
        Executes a command shell one-liner
        
        PID:5800
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        23⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:1692
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        20⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:3524
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        20⤵
        Modifies registry key
        
        PID:5920
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        20⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kqYQIEIw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe""
        20⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4456
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        21⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:2328
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        18⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:5836
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        18⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5980
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        18⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cmoQgQkY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe""
        18⤵
        Executes a command shell one-liner
        
        PID:1676
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        19⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5672
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        16⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5148
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        16⤵
        Modifies registry key
        
        PID:3420
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        16⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YEQoYoYI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe""
        16⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2160
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        17⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:5688
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        14⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:696
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        14⤵
        Modifies registry key
        
        PID:1256
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        14⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JUEIIAMQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe""
        14⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        15⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:4312
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        12⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3956
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        12⤵
        Modifies registry key
        
        PID:1420
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        12⤵
        UAC bypass
        Modifies registry key
        
        PID:4540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ngQowMAw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe""
        12⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4564
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        13⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:1500
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        10⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2108
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        10⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3704
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        10⤵
        UAC bypass
        Modifies registry key
        
        PID:1632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rMsoIQUw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe""
        10⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3724
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        11⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:4444
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        8⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2996
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        8⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5360
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        8⤵
        UAC bypass
        Modifies registry key
        
        PID:3020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UYkswQss.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe""
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3872
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        9⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:2024
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        6⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:3408
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        6⤵
        Modifies registry key
        
        PID:2768
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        6⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4700
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gsIMIcwY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe""
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5932
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:3900
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies registry key
      PID:5876
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      Modifies registry key
      PID:1768
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4520
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VWYAMUUA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe""
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4956
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:1916
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies registry key
  PID:1888
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:6092
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - UAC bypass
  - Modifies registry key
  PID:5140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xiAQcAMc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock.exe""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3908

C:\ProgramData\YGAoQYsw\PSoQskws.exe
C:\ProgramData\YGAoQYsw\PSoQskws.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:4880

C:\ProgramData\VwQUAggE\OOoMsEgE.exe
C:\ProgramData\VwQUAggE\OOoMsEgE.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
PID:4340

C:\Users\Admin\hGUgoMkE\eUcQEAoQ.exe
C:\Users\Admin\hGUgoMkE\eUcQEAoQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Lwsc.txt

Path C:\ProgramData\Lwsc.txt
Size 8KB
SHA256 c56d839221d79822462865490e9d186577c218389049400db8fee8de12256848
MD5 ccc17b64839af925f62b85721d3388e1
SHA1 64dad4a3e212e186f4fb96f182d427f6f1c93a0e
SHA512 be1cf90734f7f0b2dd5a6ffd7f4b1ccca671c85b83bcd6d2eeac4ee40ee34c6c6fc4110131a98548d3fe15a121bfa10bfbd8d81419a446ea044008df63c468ad
SSDEEP 48:U563KS01Cys3KSwM3KSqk3KSjM83vE1Cys3vzMUR:XKS01MKSjKSpKSjfvE1Mv9
TLSH
T1C2027E312AE8167FFBB751B1C3F108B16927F8526A14CC8EA076424A4477E825DD0F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OOoMsEgE.exe

Path C:\ProgramData\VwQUAggE\OOoMsEgE.exe
Size 1.6MB
SHA256 e5df9d027f1088e9d719cc6b32afd0df96d60dfa4594a3b5cc0b99ed4fc748f1
MD5 5405d2bdf81deb9acf58803e9d3af93f
SHA1 977b302ce5736238c588703c80186f84d7673b2f
SHA512 4d9bad0bba30e2685152310e582744eeb076ddbc51c6f0e0053afcc655e4024c3bf3e916c7f8b2fdaba8739159536aef537c48f2aeb16679616392ec8852f1eb
SSDEEP 24576:1TgxOfnQ6nJfA1HhNFkR33wx3HRkANlWamt3VxD81Ya+zgt:hrfnQ6JY1HvX7UHjxD81Ya+U
TLSH
T1A17563EC91C91778BFAFC7E2F75C9FA6F41511C9AED446882A634088D18608ED73E09D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OOoMsEgE.inf

Path C:\ProgramData\VwQUAggE\OOoMsEgE.inf
Size 4B
SHA256 af9ce41a0c9fc43351de924b24a9e70150aa80e17944923d88112aaf1a6aeae8
MD5 8c1ec0a6ade6dfad851c481c0b265ad9
SHA1 68414e38b733e1870df347557d2778405b383fc5
SHA512 797fcab2721c3f678bb67ddd94913af5a09328cdddc92a98369ff4fd881f26eb816518a963632f2a948d08601af65cac39cd2f11cd01240beeebd2bfa01c3c3d
MD5 SHA1 SHA512

Submit Download

PSoQskws.exe

Path C:\ProgramData\YGAoQYsw\PSoQskws.exe
Size 1.6MB
SHA256 32bae5d149343042496b3b9fb31d8879b6c7552c78ef8b98dced8e02bc144467
MD5 330c429c98e7c1cb7205e7864c39d112
SHA1 b431902463e427ae3059f97bff93bc5162dcb376
SHA512 821f8557c890a03940e48b49cb346472baa3bb4feb986a1aad272e0f9cf6041b9582ea1acc8d9980c4e42d58f8138a5d7e768ae39da67cab4324d5f9cd152c77
SSDEEP 24576:O6ubEbKccKbOWPmbuz3s9K88PNFtGGTUlbqbC95QKQlqA9tG5HwGr7R5fhVTRXl8:O6+vQlqssHPnlweyvyTxJCTYE
TLSH
T18475AED1D552A5D1AC8A220A4C72EF33E9B3B38F6FDD9D73750EA028997244ECA44743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock

Path C:\Users\Admin\AppData\Local\Temp\2026-08-07_8310dfdb1219cfef7140adcd3187ab80_elex_virlock
Size 43KB
SHA256 609824cc9c4f6c26c529ea3eb6f112c1a7c74d5ed58e25b6f9d88dce5944626a
MD5 7051c15362866f6411ff4906403f2c54
SHA1 768b062b336675ff9a2b9fcff0ce1057234a5399
SHA512 5fcbb98b9f421ee9884b8e927774de3d60043401b2f746f7af6aa059fa8a7c48f00ec3c2437f8e6687e0c328d0d2c79427d5ab5eed0805aa9e2a8b12a6418f08
SSDEEP 768:535IyJCYFakAnKI1Uu0IIjMwFtNy2Sp9oRnMcHCe+X28hGlrBw/21Qo:7C0AKImaIjM+A2K9mnMcHX+G8h2
TLSH
T18313E1C44541B3EE3577415134D8B0CA37788A7764582B19A4C42AEA7D8BCA3E7AB34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VWYAMUUA.bat

Path C:\Users\Admin\AppData\Local\Temp\VWYAMUUA.bat
Size 112B
SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
MD5 bae1095f340720d965898063fede1273
SHA1 455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA512 4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
TLSH
T12DB0924C2C8880FC0D108E82881CC42AF1CCC0C1C394401AA0A30688E33CEA89ED6AC6
MD5 SHA1 SHA512 TLSH

Submit Download

file.vbs

Path C:\Users\Admin\AppData\Local\Temp\file.vbs
Size 19B
SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
MD5 4afb5c4527091738faf9cd4addf9d34e
SHA1 170ba9d866894c1b109b62649b1893eb90350459
SHA512 16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
MD5 SHA1 SHA512

Submit Download

eUcQEAoQ.exe

Path C:\Users\Admin\hGUgoMkE\eUcQEAoQ.exe
Size 1.6MB
SHA256 c704c35ff0b08590e914817c6c8c12a1654a5572218051d1f4355b3998faed81
MD5 63410c026cde1eac94faf9c0ff9d4c7a
SHA1 ebb8226c90e44805c3086e20baaaa03e96c4483f
SHA512 862c68ab797586e3d07fb949683aeacb108a5a56fb561e31952503e21f61b3b103d36fe2d72655f3f0ce4da8c11a1c856843998b2bf3e0942d6e8bbce8dbd50c
SSDEEP 49152:R2EmgJmXXwR3KC3eP6sk1yz3R30k63v3933C3ZnI3BbHnl3o3p3bvdHXm3gdh3w4:R2Em2b/LHhhvrjOIkTr
TLSH
T14E75024BDC3784C5A0812BB44D683A0A6AFE79D782A72DB0C7D6183711E7514A2FF1F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eUcQEAoQ.inf

Path C:\Users\Admin\hGUgoMkE\eUcQEAoQ.inf
Size 4B
SHA256 11bb56f38236168084e533800659de620712d049b106dba4de5547c986ab3fc0
MD5 c6a8fe05d9be0e3890cd4b3e3697b113
SHA1 0fd94f33c931ccbb3e20b75ff31fe5eb5cc1897d
SHA512 94c955d49b2cc21ce529fe073db5ae4d8d77ddfd723a47373ee1ffa3a67dbf672e75cb385d250b6827214faca1d74aa49e5e1c7ba040bf4bd42634195d0b23a7
MD5 SHA1 SHA512

Submit Download

eUcQEAoQ.inf

Path C:\Users\Admin\hGUgoMkE\eUcQEAoQ.inf
Size 4B
SHA256 3d08d9ff1bda67be4063c9f2ce5f1dec7e5de61c043d619da73e94c17f9c5451
MD5 150fd93e69ff3a5bb662c6ca4eb07c7b
SHA1 86ca45874e9c27fe47252719e774bf1586f6e067
SHA512 03500b43ad4d90abbfbc0f1276d62e9c19f48c045254c5aa95328d964666c480dee8c4bed3d6b9569174670d27daabf3938658ca76c1a7a2db713f5917999efe
MD5 SHA1 SHA512

Submit Download

eUcQEAoQ.inf

Path C:\Users\Admin\hGUgoMkE\eUcQEAoQ.inf
Size 4B
SHA256 1b41289bcf6838d5f16969307051eed91861a02f46f7ce1b573f12f7d596edc4
MD5 373cf2a8c056b1b58fd5ccb579641102
SHA1 b19ecef37ff631202aad0c5ea4b10f5dba18fd7f
SHA512 dde0670fcfcba31f4da6475b1a6a3cfa86b7ad89fb913d0e40293b68c572d2284d7164f2d964dc658c92d2a2c775d76869c5f9a15b54ae9f7ac05e86e4389381
MD5 SHA1 SHA512

Submit Download

eUcQEAoQ.inf

Path C:\Users\Admin\hGUgoMkE\eUcQEAoQ.inf
Size 4B
SHA256 29186adafe3dabcde1102ff54812e40ae40d45a2a26caeba0b4a36642ba9ac07
MD5 aae55c404757a12d5020a2c9c361e8b1
SHA1 18e923aa9358a1a0819105bb4e37b422001adb61
SHA512 f125cf83ae9a0ae575386d2465815aa8b14cd5ff431bbe6bd3f3686a543a90e316dab61a5f66e55c27243c643a19b7b89424d38816bc77bb2312a173e9038da8
MD5 SHA1 SHA512

Submit Download

AgsU.exe

Path C:\Windows\AgsU.exe
Size 1.6MB
SHA256 02e0c0e64a6cdc5f29e3cdec5db498751189f9efeb54db68e18cfd8283af4dcf
MD5 77d5d555aa5e2667a74c1da3dd97a3f8
SHA1 4faacf4d3117b55281658db7c1271773fe187fe4
SHA512 92d03a4f9bd73cc06deb301e9aecccf2765976cac1c61aadcf6c09b4aa9b99501a1ead61be9d9fb10d33307d1b0993a3431c8911339f72f9a1d233d5ebaaf36b
SSDEEP 24576:ECah3K9mK1ONENNSNNXNNj0PNpNNNaNNLNGU7P47b09Gg6nl3qTYLfHkafyJ62L1:uha9UxGg6xqTYj/2L1
TLSH
T152755242CEE0593C6767A4BC1E3DF265471AA789B7B633889814C6B430EF32D8D6C94D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AwAg.exe

Path C:\Windows\AwAg.exe
Size 1.8MB
SHA256 6f42cdc95366c94b65b2d8b9e24bde0b2ba828e5517ad4d219ff3c508ecb387b
MD5 9efd55df749d7f73eb7773a42286e2e1
SHA1 1c59ac7cbbfbaa36f74f6ff7379b142ba5d15491
SHA512 43f1faa4a9a06aea65f728c20166926c601fe4df6324c355a21d7b85769bfb6d8094ee6390dbaab03460e7e81a2c2a07601a7a6da321b417bfaa92b7a1bc8626
SSDEEP 12288:Uz26UecSfiCfyd696gBQnaGwI/nAcv2FvVICOvs/0Pcb62eB+WEAsNeOqtRUw4am:C2fSaCad68giVjls/5bXeB6gUZaPPU
TLSH
T106952107C7E3656B2C75BF94E94043BEB79F7C48D6910A23E3302D91C0694DB98A74AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CIAc.exe

Path C:\Windows\CIAc.exe
Size 2.1MB
SHA256 ced7584aec0b91e9d17e9a1a353392df42b7fd0de84b00ac036bbb05ef7a0d37
MD5 65761bc69a71a0b3eafff9eac328f91e
SHA1 2bab5fef19c4240091d96d3e1e428c3af4553ea5
SHA512 e9aa17aaa82fcbabee5c20bcf5c4641c9ced8198cd59b201e652c344570a8f3f89faa2a4f63a8d9d0c91fa21be08e52af66051a7a0e15b7b0a7690fdc783a536
SSDEEP 24576:xRe11TwxB8b9tLZjpJrmSBb02YSRjNUIePeVeHMN/RTXlJFPYmmopwdN5XRC14Wb:cliGVsMXTXlJqmmopwJR5WgOcpyl
TLSH
T130A54D3316A9C0267A9D7005ADDE021F0E24B96CD2CEB2C954A619740BF8CFFB51E7D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CYQQ.exe

Path C:\Windows\CYQQ.exe
Size 1.9MB
SHA256 7d3a432590d51a7c243fd149f76d977ee84c9798d04efaf5a36e91bbabe92a19
MD5 3dee16899853d768c57da3e8111590d1
SHA1 269d77ab421d5f1cc59ccf0744d239cf49e19576
SHA512 28f73bac1194c2e58ad33965ac95c5b5651ebfbc25f885fcdcf7d37fd690a140cab68dcb322d040629c39a58b78fc28939b8216205e60dac5cce135acd62c5f5
SSDEEP 24576:Spu5vl1EWOSoeDQ+i2gVFwxIRmeItEeN9WI:Spu5vl1ElSoIl9tty
TLSH
T1D395316071A35E43DFB60717835ACDB09AD6D017BC9E77AA1D9AEF012024A0AD0E77C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CkIA.ico

Path C:\Windows\CkIA.ico
Size 4KB
SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
MD5 7de70c5f9fde94ce0179324aa5720a58
SHA1 b34c69a980c52938d5b4377376adf15fad17dce6
SHA512 0b5b089bb8ae1a97e4a882f7e35c7295cb81127f0915379676590a2af296012782192381e2bf3d010f0a1c693e2eaaa2f083fd8fdd7c3191a8537b4553676ef1
SSDEEP 96:dic8fY4M1c/wHtOMreoBKc/0+ktbWrrdT+AP:dilkc6OMreSdStbSCA
TLSH
T10A91842274B416E8FA7DD977E242E0AB0E723C578B41422B71D3F7A70C710D81B0692E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CkcI.exe

Path C:\Windows\CkcI.exe
Size 1.7MB
SHA256 0f01d0c6dacb865780f756158c98bbc9376b86ce5a8bb0214220c759d88b1c09
MD5 9fcb21ba0f4f2f06f061542912bd1f5f
SHA1 8fc7686fd160f9e87ff63c9a17e8d4811896f50b
SHA512 c31199f9df6850a4f6d902b9df7d990d5ceaa3d41088e10d4310efd7deffd1ef06644ce70e2e96c9f29003a5fe64d9c885e31ae85169b72b1bab532671c864ee
SSDEEP 12288:bFTQDqczJpMgnlwQdd6v1BHrumqET070YmmYv9k5r7v3Az7+L+pRy0Rvbg:biecV3nlBdUpqj0WYFk5XyHRvbg
TLSH
T155851BE18D22726A7DF470EE42136FFA0CDBE87E83217492452561759ABF094FEC22D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EAYK.exe

Path C:\Windows\EAYK.exe
Size 1.6MB
SHA256 14546eab201fac645de8d620281300311174ac6c55c496e011ab234b4f70712d
MD5 0bd6c86c1aeaf02a4c6490305f53d139
SHA1 4622c69e4a6e15bfa96dc1096c0b6bc9f6f335e3
SHA512 3da95c3e28492cc31c0b87757b5322a5b6b41c13036c0470830acc445df42a0168c86fada3d365bde1fafb05f6675ee3d68407f1466b24d9129c19bdf9791410
SSDEEP 12288:dzfdGY5ou3hU5rvYasJTC9+VUT3gEVXkLr/UGi9gDef4TsdqzHgmA0a+8A5iuoAm:dBGY5ou3hNq3v0Lr/Ri9pzb3WTR
TLSH
T16075A839AEA7102F6B0C6171FDFF5B1162E0C6B3CFA2BA57418115BA21D26844FF6C49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EIwQ.exe

Path C:\Windows\EIwQ.exe
Size 1.9MB
SHA256 433ce49213319f0f0efdac09c17609de9395e453d1904be6d9f38c8a081e865e
MD5 409ae68828bd350c72177ac2962487d0
SHA1 c05b0ff40fb52daf1b65f76637cea9af74fb09df
SHA512 df495f33b7cb28671f2989e07c7dbe8c36fba3ec6a53c91bd34532e76ee0aa2ad1e1a4c51c45ea4d3fd52f6dd7e97adb5317b426cdbc5f0d9172bbc8f0efcad0
SSDEEP 49152:E8vK5pauj1FmeKwk60T0Etj+vV6HsXCKZAvCKTCJ4YBrLRf1SsOallqhPo:U1F/vVaZYrLRf1LOo
TLSH
T19B95FCF7E629E8A554C7B5665FF88A5C90EAB28CECE99DB324D03102527133FF521E40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EYwm.exe

Path C:\Windows\EYwm.exe
Size 4.1MB
SHA256 e01fc59d4784406fb526ed60de3affc56f8a259d9a438186125680c5dc03013b
MD5 55ae0781168a8c84ea5b39f3d702f9cd
SHA1 ea72650d4ef632b42654489c187e0bcb1336ec7b
SHA512 adea45a4794dba62d3e803b18e8630c2decfae493d4309d9f5518a13bca4538236db2a002651923a74b7abfa31ca0a944b357c1ffe955885b514795660326f7c
SSDEEP 98304:nctuMZ3kAiMm6CG3173+EK42A1cOfiwz2wq0WtFor4/3cvwlLK:AZ3kA+R4SfwqJtFs4/3c
TLSH
T13016062BB10716EDDC9770EE3EBE4086430C9151B79B64E7AB435E73AA7580B374A6C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GAgG.exe

Path C:\Windows\GAgG.exe
Size 1.6MB
SHA256 cd5063f9c9411231829320a44fc393c77cdbff6e614f75a301066249946e13c3
MD5 03241e335875a1dfbc56bc1432d69571
SHA1 04c4745723bdf00946e367ab944e154fdeddfcb9
SHA512 a5bfd536b3b894d664410c259098d42dbff0318df4f7ef401c839412fdbb044d2bb0993f909a6eff169ee192d8593680089e6d17005cd217c3f99cbe1788b12e
SSDEEP 12288:kiymYmTUbnkn0OuX+GwYhO2NBSA5n/dxmFuV+3LICZQ1hdPh:kxMKk0huGNhxNB/pWLICZ
TLSH
T1F97547249DBB5EC042B6D617828B21ED50F335EBF05DFBA76874FAD8C8809542D4E31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GQIe.exe

Path C:\Windows\GQIe.exe
Size 1.9MB
SHA256 1d856c78d7cc45cdca023416a70ce5ff7b29d24e8f36ac07281cbd4b353f83fd
MD5 b6172e1d0216c3d0796870c510d44598
SHA1 b533c04e9b61e75170636eab6daad8d079c16a79
SHA512 129be44bb519085a97f686c6e4338d4dcc3d80e493c397d0c57c5670c163c0da9e03a4f3822ef7bb53c72ec92bf2ab0a5b65dc3dd64083a96f8a233425c1ab44
SSDEEP 24576:rteurcTVJgOcWDnE4FkwUCEZDXQcfgmyKrr6n1YPSopgxyr+foMj:oRHcWLEbwVEtgc4mRP6nOVHrSr
TLSH
T12895C7A938F8D524E30D205891EEB57948E3E0F2926F8F70DF9E16C339427D26595E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GQkQ.exe

Path C:\Windows\GQkQ.exe
Size 2.2MB
SHA256 10e3567068307ca6b50aaba45eae1e2871ec489730ca9e257a831cfcb68a6647
MD5 befa623edd567563b690cd1fcd7d5bcf
SHA1 248e9eb81b177c94bc84fcf17a2b9cc9afdc3851
SHA512 dbaaf3bb440c591b81722d0528039541b0a24b57a41e5dca1a60e080d44e9903346f678c7add375bb5acd0dd654feebe685f69562e89c443eaf76f9a40043673
SSDEEP 24576:NHiisXgMINH8rPhfm2bm8nyTlUUmOag62Y2CoDb0kUOBe7:RiisXgMsHA9m8nQlUUmyXbn0kUIe
TLSH
T171A52DA22D848C99AB233A6069FB0A418918CB45D45D64C7CF5E3FD043D67AC7ECB74E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GkMc.exe

Path C:\Windows\GkMc.exe
Size 2.0MB
SHA256 b564238ed0508cdd05df0e4ab3dc560ae5f1aa7cfa64dc7ceb64d8e2389ce79e
MD5 96815aa72ffb1f557299d817a1c39401
SHA1 a455a6290f917a7aa97621a44e9a42d8bb76ebc8
SHA512 534b62ec7f869c609c3d3baaee109e1f3883013b339574814dcc281f92defbd6beceabe0e9e0dd4a11a18e809646c7e23316793927a5f3168af5b214738f0272
SSDEEP 24576:8toTWEQsvWTKgj+5/ezXcqVgrKPDl37R23aAh+1X3RH5eXCm5Qi5cbZD5:WoqBZpjkkDP1kthCRH5eXCXi5ctD
TLSH
T147A56227E223ACCC4E206BE27B558A26CA4FB93D5915DFF23198DA4C37E7584054A373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IUkc.exe

Path C:\Windows\IUkc.exe
Size 1.9MB
SHA256 11511808b238b81a35edce8c9a75e68dd3bd0397e9644b4dfc8dbd703c5f3c94
MD5 8f0bc1d07285cdbb3978bb303ad10100
SHA1 9bd6dda282b87b1b001729e7f8a8bbfd6e34e8b9
SHA512 e40e5f2e4eabd7af4012097a3a2ff8b272fd541a3fdec827c59468df51a3b17284b960c4cd7480fec4cf5847e3b3a8853feed9342f0e9c02267e594ed5f5e45c
SSDEEP 24576:kOS20Du3K4zs5GvSZtjKO0XJRxETIPH/DOVp0uy2hzf6p:kOV3aEsDZtjK5XJRxETeSFy2hD6p
TLSH
T1F59551DEF0AAA3F0F8F0804D1F19E8F5B9465EC18C3A7A25695DE442D6F2D2811E6C4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Igos.exe

Path C:\Windows\Igos.exe
Size 1.6MB
SHA256 db521f51d4fed721e44f50b9c9e56bca722be14c494758f9c42287cbd92a61c2
MD5 0d6dd4cc05d765201ea027f4e41bc197
SHA1 2fec3729c51792604c32e6308000c20b26633513
SHA512 37d98dbda7186405461d6dd09a4002f95786842104b4b0bb257030b17e6fd0ba086582cc3f28557111ce0b9155e0689625c42180081c69ef3fdb8afe5a98b0a3
SSDEEP 12288:4dSBPN1pXF48frO6Lys+/62d6/7tu4KKtE3LwCf8rabIkjBh9S6akh4JVGq+D5:FPLys+/t6jfKj3LkrSw1khIGqI
TLSH
T1EF75779ECF528D31F10BADD28D60EC12DF9AA691D92351F72DC51931A2BEA2730F4853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KAAG.exe

Path C:\Windows\KAAG.exe
Size 2.2MB
SHA256 dd943e4418c2166aae5ef6ca0de470337a09be0ea29c78b7303236a6d85b7b9e
MD5 78f63dd9d4189aa339d3724c804c45e9
SHA1 2190e19d18cba6bebc68f95ad9aa76011ebcfec6
SHA512 059132f12f85951e9422e786feed5dd7d0b3195a0fbc697e7f0d13138a7f71dd583c8719d4bc13050e7ed4c1808894becbf47bad08ba1c9024bb7371cc4374c2
SSDEEP 49152:IEuDYS0kMPQ6I9ZPWo7JAnB4PvO6Xx5TjdYiO:FucSMY6I9ZOnB4XO6X7/dYiO
TLSH
T185A51F5405416333ACC66A271ECA0F95802E8FA92B76BB37617DCD24746D8F885FE8F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KAoM.ico

Path C:\Windows\KAoM.ico
Size 4KB
SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
MD5 743bdd687434129391fd0c5c75f33ef3
SHA1 ab0696c2d38531ae88707df5c6f5e21cb8591a1c
SHA512 8b1a87f915c6ced6071cdf4a533ebd5caa93197687946dfaf8fa0d28c358f38b1b1e232329ff7ff73950d7d808290214cc1b7114ba97374a92fc5fd0ebbe585d
SSDEEP 96:tzwwwwwATlRCDCkiZi8C6CbqHTTejtjmjFj+RIW:hTlRCDCkiZi8C6CbqHTTE
TLSH
T176911A3723595C35FE514DF0BC9A9A9CE088BE5483C22D9427EDF99EB47D8C209FA850
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KMEA.exe

Path C:\Windows\KMEA.exe
Size 1.8MB
SHA256 e13e0d9c740303f1424194b1b298bcdfea3d9ce33f8cd8ae01166df7747164d0
MD5 1b724ca8a7f119dec8a7fb06d2800952
SHA1 fced1b4a368077677e97e2fe44299ce466f9e129
SHA512 d68edccf75d73c322a16653bd98d593328fe7af4252a40bec574f2209cf19adabc67a44ebf2514772805d1bd397f45caccbf2d620d48298e0b04b58c96a61b57
SSDEEP 24576:pQR+DNQjy1kZKOyUs26Z5Cy3gdMO8f2LebxQDcibS:pQR+DNQjy1KK4pIBwdMO8fZ
TLSH
T15E85304EC5356C016AFB732C2BABF41C4F2F567162462C5261B6E66B6CEC963C34CB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KYIu.exe

Path C:\Windows\KYIu.exe
Size 1.6MB
SHA256 229690fd85e22964a8173e1116968a5d5daa5f98f8089d9753d5b545ba57e640
MD5 f9eea08f179f85c9d7c109c0922cdc97
SHA1 8c0555e42a9b259c55ad3eda3abee42e5de42fdc
SHA512 0204e2ca5e419389bae9389304a6eb4bf29dd199e15e7acf81c74225190300f6fa9dd00abe96f69335630818cee24fc1323317d9a5bbb821f23b97817266af21
SSDEEP 24576:iYnHcvgEhHtyyTK2HyO9RoL7mqQlw9v3uxut:iY8YETK2HyZL7ea
TLSH
T111751A7A3F2E87E1022CCAB4771CAA820FB85915E8FF209159775CC0705D8966FF56E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KoUe.exe

Path C:\Windows\KoUe.exe
Size 2.1MB
SHA256 2ddea8caa850b4926ce114b3fcbba57d2721e46b0335869b51c695ed56877beb
MD5 34c32baefb644625b72050c391269c7e
SHA1 bf27a4dbfab76058cdd51d88819b465326ddbf81
SHA512 e9a836ba1fdd05f75e868c8176750219cf29d8dab34b202458e9f10116c5ee12f5445c01bacb19013f470fbf0b60cfa7c9a011a76ee8fb2aa2773b6737039648
SSDEEP 24576:DOTELJ1ZiOjM0QQsMq//Z4X7xFlR9ZLY+t5Qh7HXkuzDE:yTELJ1Zi5xQsMq//SX7x/1n5Sbw
TLSH
T14DA510EC67D4429C0D33E30F99ED5DB1A3E989F80DB18B428E7511EE2B411DDA06798B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KwQY.exe

Path C:\Windows\KwQY.exe
Size 2.3MB
SHA256 a781c54427f338b3a6250ed710888069b9d8820f67b8d56d153a298999d9595a
MD5 024a4e419c34435cb1a7a6f93464da71
SHA1 38d39010ac4a71ded89d0e64927dd8506543ba03
SHA512 10c079a9fa6af64611fc187516c8db2dbb3e844b04b60b779109d4599908eb7fbd583d1207cbf615f5779b7284932ce93baaadaceca6964fa58642edbaee81e0
SSDEEP 24576:3BknFjUqdtyB/Slr7qOOSLqc6Bz28oJ5mDJYZQoYzjEODSRLmmAhvlCCv4xGEdVK:2dtrGPzt2ZJTyEODummy7vOfd
TLSH
T12DB5617EF14E613D026C7C3A3C04B2E9652A3A6F963055572BD4ADB263C1F2486F670E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoQs.exe

Path C:\Windows\MoQs.exe
Size 1.6MB
SHA256 f2148355c1cf077506fcd959468b514f87931b10ee0ccbee9a7eb7581089f2cd
MD5 b6514c79afed4777e44e9ede0d30b6da
SHA1 91b2ee90254d2716a5ca00816d3ee44d81f896fa
SHA512 652ef2f3425478f8a0fc0c3743e8223e2c5982608a2f1c6c33446832a4126441b4b52cbdbbc4cdee77b1556767724b783e0f585e7aedad827ac6dcac8ccaccc5
SSDEEP 12288:64xMldVUL3DzhsqrUb1u2WsHxAlPgHWZ0cYF2dbCJnYcOMeBb0EkpHkd0m:3MldVUzRpAgy+PgHWqcYF2dGKckbrd
TLSH
T17475BD7831090D3B77867019B76C7369940DA0AFFDB9109BF5C906E9ABDFCC489A2874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoUQ.exe

Path C:\Windows\MoUQ.exe
Size 1.7MB
SHA256 1ee743b4dbb12758e181869a43c2819da7ac43cf53336b551942b5018dea0fef
MD5 6744907d82fc3b8814bddef272ae5334
SHA1 575020df146cb855900dfaead5113260848787ad
SHA512 b02872bad2cd5c0ddab20b9b238d4c424e7caff77ccd958c487753340328299ddb7944919d7706e7dd09d95c28b01485d649eac180cec50b810e4b2aec950d10
SSDEEP 24576:sJZ40oaDAFDX791w0+byVXrw6H9XEDb04:EZLnwj791T+bKXrfH58A
TLSH
T13985DCCA66ED0636AF6050D8DD8F13B007BF606F779B5532A1E5051CCF2939A8683DE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OAYe.exe

Path C:\Windows\OAYe.exe
Size 1.6MB
SHA256 68666123670043158129f2db7fd8d109916fb6a6de315ed4fc91e6c7b1cde062
MD5 5cf3eab16f0eb9e21090803319efe903
SHA1 3d0593edb7130deac05c3043f0082f4e91f6f13a
SHA512 35e194655bf91078be621685881ab76d859a84208ca8581459aa06d9ede8265cd8b40090fd041f90ef0d0dfc682458151589669f9046d42e832d3066e7711957
SSDEEP 12288:u5TeErpzM3yLilHe/nAO8OsGU3ns2eBmNqmQ1T5AcrCx3diD7hj/A4/ewQ+pl:8TfrCiLge/n6C10NE1RmxEd/vFD
TLSH
T19475AAC90D83D488D9AD427C77D2ED0336F94ED42454B0BBA497AA32F2787C2D6ACD94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ogky.exe

Path C:\Windows\Ogky.exe
Size 1.6MB
SHA256 50ffb167860c5562688a54b2ad592f3e394e3d6573f5d5f258252fd542b18b13
MD5 f1afd38b2bfdb666040b0c8ac34528e2
SHA1 bf8acf55ab18410c3176e7865548e9eec1395758
SHA512 2ff90ffd1a738f0d268287bee2408039254b119fa8d8f646bd3fe0c644e83cc8127f3b60725d3be66eb9a5cf2d4070d663e189688456f339c15ac79267a7332e
SSDEEP 24576:2XM6ZolZYsr85a3sfImr0DM4+HdeXQ9TXEL6t8:2XM6Z6U
TLSH
T1C97577AB8A70FC31CF7F8BE55FA5AA0D9A170920C17104597BB393075C5AAD0278BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QEEY.exe

Path C:\Windows\QEEY.exe
Size 2.8MB
SHA256 1510db4fdd32059e29e07766ad48b22420d38d499299f84c96b3f9c612236b16
MD5 706d9575f1df2e16a6bf967bbdc0b535
SHA1 00dcb2611cb93f5035a2714696190da844f98a70
SHA512 deca510a0d7b3a74d782721631645cae6b363fbd2d2234abe1f3f360e25a942059db7d1d2d5cf608a9ed9216c18e15781238980a8d32f015b477d6b7c8794f6e
SSDEEP 49152:VTrlzGk5tSOQab92NzjZOF/barIQYFtf3YNKtxBuD6FmFG:VtzDNXJvmGFtqi0FG
TLSH
T125D5A5B141800F127A937E9A3E480D20E626C63721FA5B89F894D9F3F5CD43EB4BA55D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QIUs.exe

Path C:\Windows\QIUs.exe
Size 1.6MB
SHA256 f087b4556f78fdef05bab269c43b212ba71fbb2ced3f47d80ef239eb4ef8c33f
MD5 aa05265bdbe1767038c761130c57bcdd
SHA1 73a195c821297adfe374ad07727f82622b9a9f5d
SHA512 a82ec4e27b3879475c63a738e10de82b24e8623ec574453b709cbf1106ac6c8e05cf15ccb05a07b7a1d944e85a3895861eabcf6a87d45a8906db8aa6b0cc6af0
SSDEEP 12288:2aBBwepbz7ZnQWWqoIkc9IF9EUBLJJ0t95eTJFIl2h31ZdnflFamJEkn/:llWqonc9QaowA33dqWnn
TLSH
T193756929B35B09309CCC470E9D3C8AB2D5D935235A6CB458B5F8F5BF628DF1E109E90A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QMMM.ico

Path C:\Windows\QMMM.ico
Size 4KB
SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
MD5 03c62b34b94a861c4f99017a91bc749e
SHA1 2ca36583370792d9d56be7e5db98417188adf5a6
SHA512 4260811ca36c05c15db789932b24767db68b0dfa1a0590e8d4f69328e208c38693e978d892e0d229756a8ab9092265e19b0a0da132f0542f8460be54ba6371f3
SSDEEP 24:su7zwwwwwoRLM4IRS00000xwbU66INLbXxtRmcjtjmjFj+RIW:tzwwwwwGLZ+wA6nNnXlNjtjmjFj+RIW
TLSH
T1CC91282223494C36F8D4CFF0AC9ABA956188BA544FD52EDC2DADF01E117EBF649F5010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QMQk.exe

Path C:\Windows\QMQk.exe
Size 1.6MB
SHA256 5b0eb5cfd63b83c51fceb3e7d6b567e969cae8146c45355f115a92f18b2f19e5
MD5 1dbc41a8e7a5cdc363bb4722f8625913
SHA1 2f50835028377d8a85827ab5358c32e2f40bbe50
SHA512 02854c1ebe6c24cec6a1abbee36095f23ebd6aec6ebb4aa0a0e9f444a4482068855e41e5acf114431a475de9e7d3a060e93086bc677a3976faddee7e5a27fbf5
SSDEEP 12288:CD0nm0ivYUmMJFL19N+qnjiKzV3dcGMvvJRNulOQUnViH:CD0m0ivYUdnDz7HMvvJ/ulOvIH
TLSH
T13875EC9A3C3142B46FF2A4901A941FCBE74AD9EB5C511F534EE28C8939538C64FDE878
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QosS.exe

Path C:\Windows\QosS.exe
Size 1.9MB
SHA256 50099f42bd973d859719d8943e33336146f5248d3e58154e1c1225a748bfdb74
MD5 71e1b7c166ae4f91451c41800607c6b6
SHA1 cbea5f60ff09d554e6fe19530051adacdc0652ca
SHA512 a2e8d3c2cd7c151efe988680feba4de0569ca280e9828e1ba3c789320271fe8139fd0267a5a50c1e9ed4efecd5bb559f767a2df0e696efaf7328e284eefa232d
SSDEEP 24576:5AYmys7ZgdF/c7W2HHnkRaxV+SAnNHmZDt2kXx7Hwa:a7Zw/c7W2HHkmD/S
TLSH
T144950AD29EB9612359CA51C9598A66D31434EEE7DBDC23830C5CCDB3CA885449AFFC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QwUc.exe

Path C:\Windows\QwUc.exe
Size 2.1MB
SHA256 82255c4c0eca576cf00fce08ec40f8b369b06f39317cdd43014c0a5432617065
MD5 ca3a649fc3838c56147664e0bfb030ed
SHA1 5f91ea0652655af0a1e1d5b3f9956f013e5ced6c
SHA512 80d24c277361fc87551cc3f968d9d9c2029df910e03e77964c0dd6a15bb2d27d82b169442806dd82d9814ec2d98cb7faf39b8216ad4c9e1d4bbe1f68d9bc2126
SSDEEP 24576:Ot8Jkt9rArekRoKL2RddYIZG9Wx2ixYgTP5+cYgpU:OtEefKCRjG9ZixYER1YgpU
TLSH
T15EA5EDBD37C23955C406A5FAC0F41362FA887199306EDA670295E18A66F87C4ECD3BF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SAMO.exe

Path C:\Windows\SAMO.exe
Size 1.9MB
SHA256 17fe848139402d74097a3fabb71283f73a8dcaa0729fa1e6a77f388c3f070bfd
MD5 241c8f48160f2eb20f3ab6403fb38782
SHA1 21c9e863b23481a5ba9a33a477366d87fee0a66e
SHA512 b94e5485efde8b1cc6c63ed3959f3c61f172d099e3e33a16cb1251d8ec5e05597e1aa672c4d57e01f6c14601f0018d7f9f9af51f83d8989b7a44c33e7defc1b1
SSDEEP 24576:Hw/zbZhGZ4w3fU1yMVA7qXbs09YgZVVJPvDEBTJQ:2RhifU1vIqLZZrZbE9S
TLSH
T15295EC5183EDDAF409485ACDCAC124584EC1B028F7860DBDE223DCB56A5A27D44F7FEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SAMu.exe

Path C:\Windows\SAMu.exe
Size 1.7MB
SHA256 93d6a995d50ccd2a46701bd01ec40aa757d187b3d87df14db449699368530f72
MD5 4f2164762e0070e92f25a4dff23c63f4
SHA1 a012ee93a425dd384745ca17fa3b11a83f606602
SHA512 347c4a4e4734d38c930171b79c929f0a85ea483d68c878f75dc688602ef7b85f31e87977af1b58bb2e2240fb252a9eb3b6c0464252326ca80faefdbe1ad8afa0
SSDEEP 12288:yaeCCfspAhA8+Z3m1FcOIPbskc26fdnn3FnMcrF87GLSPf4pWdDSRRlJill0ITQ5:4rmkTijNTQQs+9WZ1jt0c6h779rDO
TLSH
T1D585DA1ED65F24AE6163068AF3CF47AE00255B74FE3B41925FD9481F3328662B3F5928
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SIwM.exe

Path C:\Windows\SIwM.exe
Size 1.6MB
SHA256 21d7fd5ec38f9578131330b4a964faa98de68afca6830c910d6c92ad5d6f2342
MD5 68c1130cfe03d5a0616552b8e577bf17
SHA1 1b5d44ca1aa7900b642205b4e03145a87d6b9620
SHA512 dc6caaf10b5d22565063bdc9c4d12911fff574c02a1012cae7d24609cdb5e0a27ebff8411de25b99fe9171a30428b61c068ce24ba4671d45fa97692728a34776
SSDEEP 12288:b9Jstr0SrJvSqtHLVXhs9wQ31OcVEkFdzDLW1Wam3a2fjks3DorQdMk9h9vZZOsN:pJGlSD1ECdzDLWwamXVMkXhF
TLSH
T11D75BCC854CB1B9687081A7F0AAD3BAA1DDEDB6EC3C0E93CCDF746552252013D9C4A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScMm.exe

Path C:\Windows\ScMm.exe
Size 1.6MB
SHA256 1867681be1b6bd39621de40705c71f6e12500c415fbb53a187a3370cdf528d08
MD5 81f1b1ab078f7dcc137f90bb29c42456
SHA1 d3f142f31efe7f37a32c3d8599ee83de5f93087f
SHA512 37f1f7da767ac11b8a4c44ca203e714090f83a1b372bf322b994ab1d3c31908fa65e666890d88efbef48839c4c60492deb247a61d7b65735a98b89a138aa9cd4
SSDEEP 24576:OQM/RAClsBXvFqOeqT7DctiVnhPneAcFsz2:OP5v2Bt9H0tWnhPnek
TLSH
T14175B8A3323F7773BBE35AB610CEE55EF2C37BB805C26845CEA93884B0D65117266191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Skke.exe

Path C:\Windows\Skke.exe
Size 2.3MB
SHA256 fe2171ad2c93028afffee2a53ab955b241e0fc36e12e2d8df14c24010ea1bb8e
MD5 9e8b67c0787362caa6879dd1bc4029d2
SHA1 fbfcd5048ea7a5cd25a165da00df8a05c3722aec
SHA512 2ac9344e934dd8fc9dcf211b8e90ddc231c07f97d69b08929673ea57e43ab98c560ff37c7b3c1b9423d6e90115c0929fd3abc36f90ef8eef4bcc3397bd49dcd5
SSDEEP 49152:zmWXW7z/RWg3/XsAbpp1CIKFgght9iJ/DgPgBf:iWXMz/RWWsAbTKthtMtkPA
TLSH
T104B51D253C79A0ADF841A38ECE663BCF731A73D61264512C5284CB3CB95F6C81A64F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SsoE.exe

Path C:\Windows\SsoE.exe
Size 2.2MB
SHA256 53b1d38616217032ccf05392dbef0284a88836e962b55a24d74a263ab1b4a849
MD5 9162a4ef817e4b4558fd77df56632ef7
SHA1 bf2bf01e1deb337bda10658d6e6958b52e28e278
SHA512 f4380580a64372f844d25f086ae14eb18c3a89a8c55e411fecab123e20e39ba78f351944fafcb2d16390a02a149b9cc54f23b30917f08a0e5c4ccdc1fd074d1d
SSDEEP 49152:zexjlvNoCSxFpiZRoYt/+2ZnDSiQoFdV:zex5vNoC/RoYtW2Z3F/
TLSH
T1BFB582023D7251AFF2119794667C5FA9FFF6885C40E33708D665C1942AF98A390BCE8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UEUA.exe

Path C:\Windows\UEUA.exe
Size 1.6MB
SHA256 0573484c87286d97545e9edca3629683210f9a3937df82a67bdafc8e08e1032b
MD5 9071d5742d79bb6fad6bb3b271e5e681
SHA1 16eab5afa31e96f3f629af42dbb14486d67957e0
SHA512 c6a48cddfd62aea77632349dc328b2936d0565c4f822af481d98923c17427654ccbba70c7db0ae851ed2d3d5780c6157ba38e60e7152961c6ebe8f3620db2c5f
SSDEEP 12288:1y75qGPnP0mZErrvstoJ+JN4IFCaBWD2OpG/la4eDfORklA/Za3zJnqgCgd:1y7RP0IErFJ+JN4IbXO4la4eNxC
TLSH
T1667566E4CE984CED2B39BAE3341FC17621C9B98A58CD0784E775504B3B51A27FE93522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UQsK.exe

Path C:\Windows\UQsK.exe
Size 2.1MB
SHA256 64a8248b7facebf8ac3abf92d33d4f0a27f124d07c71dd70a454edd8679c8f1a
MD5 12250525cff3d98cde74da40966945e8
SHA1 3761eb477240763de3e676c7905012ac45bf7b5e
SHA512 6ee4e4ef4dd8f04e01b769a9a8dd6a8be4a8bb0aec3eb5e13c875e8f8ea48a8043fa38f7cce328d2b240aa0e4a52e038e6005f854b3baa929f87b3c4d4c47fea
SSDEEP 24576:HttAsSOFD/p9aKQahX6XL4aCtEDXjf23oRC8fCcuTP:HtW9Odp9a1mX6b4aCtgrUoR27b
TLSH
T10AA5403F25E3E76420BA376293501CDD8B51974BF80D7382A48AA9C18B7CBB9D43D917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uokm.exe

Path C:\Windows\Uokm.exe
Size 1.6MB
SHA256 d4f5bbf235c1301a7e81f9a24e7ea5c3a8192797dc4f753b91fae405e943c8ae
MD5 8dadced95416d969b73af3b9da251cd6
SHA1 49e78ba89ef36d6930ae3d85d2b12149c195543a
SHA512 db7fe4acbc0696b0ec586caa3cd34e728c3dda62a09a646193256c39a00f730bc6b287108d28ce077da11c44ec6f62bf0ae819738cc159b09f9a70809631a86e
SSDEEP 12288:OVPbIngpAUX8rlB40Synnt18+F9V0DZntLhGRee5Q7/WnudW8d0fak:GIyAUX8rlTn8kVA5hGlijWH8d0
TLSH
T19575A61098274143513FC7B3D0689DA6B3BD58E49EC69585E78210FCFAB58E3B29BF84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WIAS.exe

Path C:\Windows\WIAS.exe
Size 1.6MB
SHA256 69d8da168a1a1788d8dfb92aa399d1cacb3894d300c3961e7e7a331b3b21fe11
MD5 c408d63d1c6346dc1503335f304cef32
SHA1 b3016f801c99df8017f52e84be0263b1d2054615
SHA512 903c7e421173ecf009e606585c57d423336ce45f381c8dfc15b10cbc1181a2ebdcb928251de4734c4e5dbe1e5921c6c07e08926c7d63e5d9893fb8fe942b4e22
SSDEEP 24576:UsXBBBBBBBBBBmBBBBBBBBBBBrBBBBBBBBBBBSfC3rNbL/zpDGnmy0whm:UslC3rNbnp3v
TLSH
T1E675995FA0C5E54CE4C88C691F8BA885DEDE303A06CD52E555AE599FB09F3F9C2306E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WIcO.exe

Path C:\Windows\WIcO.exe
Size 1.8MB
SHA256 a97bf9bae8d99bb0b17c4f42c00f6f8b097703ba4f412cd3758660c3e7728ff0
MD5 4cc07ff110794ecb66fc65c1a8b21374
SHA1 7e20594ee9942e7aebc18c4dabb059e12a293646
SHA512 7dd23814905a7a58e229558436b70ac6af97b7991b6bf5a0dbe9d9c13f20484b741fba477362f2f9e7e97722998694bd7218a832bf30373c46f27509e4b2b105
SSDEEP 24576:ChJTN8xwLKp5EnYFaHVLbMEsKhW4/h5RBEVD:ChFLbcEZMEbhX5DEV
TLSH
T114953D094902D654A685CEBC73E36A00815A3F5505F3B7563CF54BEAE9C9CE02B12BBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WKII.ico

Path C:\Windows\WKII.ico
Size 4KB
SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
MD5 04e9ffd28b9cbb9ca06e99dfd0c7878b
SHA1 44d1ff600e81c6014965bb30684eed29ac7c538e
SHA512 22bf260e1ab53d90c8b3083cae8d9fcfcf6ee19fe30d61c6074ddf38823afa4bc6bd738441bdd3e221131f4e87a750c03f64ac78cffa5648cba737c0c623d888
SSDEEP 96:xB+p+3sHL25ogAJpogoMotGcz55Xxm/frxO1Q4Ni:xBK45LAJprLq5mCI
TLSH
T1A1919C6DD785C54EC0E94F76D3364C77E1679C2B8E79986E024C31EBAE321860829D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WUAw.exe

Path C:\Windows\WUAw.exe
Size 1.6MB
SHA256 eb4687ed83bc9df1a19647fc56eb3f5f77e7084e4880682152cf3fddf0c55fec
MD5 03dd685a1aa88933c71b8805566573a9
SHA1 c370d8ab51b59ab4322d8265a346f9d9add7ecbf
SHA512 97556cad4ded303a46acc31800dee056fbc74f9ce508b283b6498611067c05761126dfbdd1947983051bbfede237059b4833908d55fc8ff4ca3b0d075c748a62
SSDEEP 12288:dDqiWvDQ4DFlDt0usOx9b3a7vqUrC5csCbyn8T/IYxsDo:cisPFxt00x9b3a7vXrC5AT/I7o
TLSH
T1B8756779D2266267B722959AEF5E0367CFFD405F2AF00FCA81E53338805FA0D514B6A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WgEY.exe

Path C:\Windows\WgEY.exe
Size 2.0MB
SHA256 db26a4f7f5f9711bb5ccab11bf3925900ac4c069e787ee739d58573579d99223
MD5 9f4e36ded9bb871f619e3f259fdb9a84
SHA1 40bd0b35fc566c8f8880e932ea1125324448e495
SHA512 fda0b561f3f4c4519f7641700c5d98ef99d48b2d76136cfe93adda8d42a849425c334b422a8973b40818706dda8ce09a117a462c85cf225db0d4b266691ab608
SSDEEP 49152:M63h/R3ooJ+tH+MSPD9ZNULABtDdZ5xy:Mc37q+TD9HUL2XX
TLSH
T153A5C81E224E259D438DB02EBA0D66D1FBF4F9C610B36A295DF4B3C194156EB321D3E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YIwI.exe

Path C:\Windows\YIwI.exe
Size 1.6MB
SHA256 cc8fe58eaf6cb0b32d494f4737223d9a8ef691c59181143567d18752a342b465
MD5 c6a17a6291626c1a246bc70d934cd91f
SHA1 8d6453c4102e91e8528fa7eee8f13532e08f449a
SHA512 53043ae9fd20fbb6937b95d923ce43f85a6fa1903b9b0ce8cb3a53b89113cf5db3b9b7f609ae791d781e5f56458e232d6efee375cfd482c84e9bd055a8b27901
SSDEEP 24576:knQ0mlnB62fVYZAG3nmvQIlk8sK/KnZl:g2fVYt3mvQIi1Z
TLSH
T163750D4367CF06CD640F2BD268F6B4BEB92158276EDE1186FC72013E0ADDAD842F1A55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YMgy.exe

Path C:\Windows\YMgy.exe
Size 1.6MB
SHA256 39bfb5026045cf39a2aa4aa67a81d907d7cbd6d45aa69efae2efa84db0d91cff
MD5 c8ef5dc61d75e9262978561ceafe131e
SHA1 87a0cecd048e306e47a01831c79c6e583f8aacd4
SHA512 6ecda63db8cb1af5c0977987f47b23ab063793fdcc018126835a9731cc23982978e926ceecb4d29d24f8ba99fb2b4561d99605300ff6887b2daa794ed9923669
SSDEEP 12288:DInfJDnSDQECKNNLfg0tpgU51eg66kZvdoUlIJbmJgIF8JivUj:D+DaCMCe71j66kZfHeJKUj
TLSH
T1B375A969CACF3018B86C9B7351708465CABC5D5F17E2829A367FA7D1B601B2C421F9F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YcEq.exe

Path C:\Windows\YcEq.exe
Size 1.6MB
SHA256 37b438126d40a0af6a09ef98104620a0fd9dab4804d69cd8012edd5136a1b652
MD5 70af72c683ef7af98789d2bdce372362
SHA1 71173916ea961ffc62e7db72e38bd70dcfdb11df
SHA512 5c63698c55ffb2cf567bba06d5ea77afefc5baf0fdbfe5e91f232faef9206d0486620e985773ebaf253fc83b824166e5b1328721790d1e015983e498a5a30c03
SSDEEP 24576:l/KpioFWNFzKN9yugZ+a5OQF3OMb0ylk1laq:l5cWDk9yJZ5F+MQRg
TLSH
T197752F5309ECB11CDDC5D1E53392137A42ED0B25778D9C47ADCE2B6B028E9134A8EA7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YkQe.exe

Path C:\Windows\YkQe.exe
Size 3.5MB
SHA256 7b21e0260180f194ac086d7a6e36f9437054d3d05f134b0a396f7ddfb6304987
MD5 a83ebfe6fa3e3868dd6d74e2d0aba313
SHA1 ac2e52e915cb07aa7c3661f86634d633f18a6f07
SHA512 82fb95e2b582c73dff012669f1f31dfcccc4aabfa49bd48f0816cd02be7245d57e826e611515dbbd28c802393468ece51c99106d854557c1acafc605f634a084
SSDEEP 49152:Zc0ZttHO6+/ju1XnoDPMsdiazl7TK/w0y0RlpPXDuW1KwwmpoElfqE:Xj+/knoDksdNlXKo0lVuW1OmpoEYE
TLSH
T1A3F53A6DDD68B85188CCAC4D9CE8C1CD3234639F658FA404E9FDF533F9C9268A479262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YwIq.exe

Path C:\Windows\YwIq.exe
Size 1.7MB
SHA256 05117667bbfb1f1cfa8c038dfe35790f1dee2fcda698e907ce884ecd8192da58
MD5 f8d9a7428c8a8dc821917a982ccb45cd
SHA1 cbec2b4ecc2d93041e60a9dfa7dd4a4f70869286
SHA512 cef12dd343fc47e3b45f6552943638217510a6c5057fbe5073074ed39d6c9ba3458a70707fab2815174fb887b7ef015ddd9616a1661a5ea7a4a304963ec2f827
SSDEEP 49152:mfuYtGRIs+V57i9/8bkErqCAGA0XSPf2wVeEOd2DvsEVVaznO+R0MZ4F+GNyufT9:m1M966c3qzDsq
TLSH
T1DC85A41B3DAB5951A032C8EE5849CF37049E874A7464B7B6D83D173ABF1A70817BC8B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aAMu.exe

Path C:\Windows\aAMu.exe
Size 2.0MB
SHA256 07b05a1d2b664e705fad88f933260451c4dd8ac383b1bdfcb56571e9067c4fec
MD5 dd84b72319a9adaae04699b2c9a4bc3d
SHA1 f19c8898701962e4e0db625e223da8bfa1ad9892
SHA512 18ba44036cedd49d468e5859ee58e4f5493c941d86cab872906dbcc553db832bd4b8c5dae2b1a14c605e68c91552c400b1080030515271897a21c6f404e446f3
SSDEEP 24576:XItzpJn8qmxlIOzY7IghSstQ39troseAgCRdx37q:spJnxmxmwY7Igo6Mose8m
TLSH
T1469510F6B940D1F614202F4A5236ADAB4AD9EF6182DD34530EEB312FE5C793C528ED90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accU.exe

Path C:\Windows\accU.exe
Size 1.8MB
SHA256 3775a678c75aad7a354ed66bbeef763e32bef9c3c25d831dcf31e15ff5d1ce92
MD5 6dec51cfed1a47988c11886e9b1dd41e
SHA1 851cb8d3fd5a2ba0a8efb7853884166495a53585
SHA512 e54eaf500ac4ace7dd99d394b8f701e24d868a78083ebc3de690a6d2a1428044a25c960db9b1cb2ee2d49795926e23504a2db0099eb872defe2ee4f30d4aeadd
SSDEEP 24576:cD1N0OL35ZTPlZLA+F8qwns35RRCH1V6dfab:cD1N3L3PT5F8Q5mVRb
TLSH
T1D785FC7B7BA8FC739A5B8860588C9471962D3112BA7E098FDF4B0450738473B61BF279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

akAO.exe

Path C:\Windows\akAO.exe
Size 1.6MB
SHA256 25a0b2ea9c62a6d22939d61d86dd2c3b6146c07779c023430f20dabf8b04fec8
MD5 31a7b2da9df9d493bf30d900f4a2eaff
SHA1 89b1a4665c7a2200c13c4181ad6570eae576628d
SHA512 e018a2aa24ebd31d4d559db096b7e79fe84b439fabfb2bebadf478a61d4736029c0b63a4e1b995762241935085f73c27434b95d87f6bb2c5db4e1c1e44153de3
SSDEEP 12288:CTEkqa1cfs3WA0cUZ1zR881IGUPOlThYQ5RLlfrAnsWbUZ9aSmIlG:U/RL3/0cx8WGUW/YSz+sBZ9aBI4
TLSH
T13475449EE2DDDB1887EC8C62DBC410309DC3B92705D652590CAE91D4BE1B73B4BA887D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cEAK.exe

Path C:\Windows\cEAK.exe
Size 1.6MB
SHA256 7e6c47d09f589011a91a74d4fbb84069c755d260304dd1b4c5bec6cf7473e69b
MD5 668e60049f90920bab4c9ccf8884fb46
SHA1 08bebbd65a7d947b01b0ff6a19b9ffcc4673f0e6
SHA512 965b4b9feaa251e73a7459646d0d604539a7e2e9a67674e3e13293bb28c78aa3b678706c7bc231e1726fbe4fd740eb7d81ea277ce52a2e49e0787ad19236da5c
SSDEEP 12288:ZV2ugzxs+eQU+p/q71R3w4t4Z+0Deq+FfKNfo5hFiSJGV1:f2ugzdevnvg42Z+0DhbYTiSg
TLSH
T1C97587D09EB5A94DC83E32A8512266572038B33EF67B9B1819EA47DDD8794C73D0F381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cKMY.ico

Path C:\Windows\cKMY.ico
Size 4KB
SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
MD5 7b65672ac808bca7c81e0700562aae9c
SHA1 e279f707d5f93cd0449443cf7f70d54a54763208
SHA512 7592be8433d2044e21d2e67cc5905f1ca3d2c05884f99e4fdf4db1aebaabb735ca1d50f6397d02ef2c0ba6e4528ec5fdc4592ef35e0e6d451e0453d5491345b7
SSDEEP 48:De3yb1JCOwbwKDo4fwmF6X3TWDIfA5+wY+wcY1Je8cDQx6k6uoE1k5:T1+DvZO3iMfaOJ18D4TC5
TLSH
T1AD91B289F71398E1ED27323498315D362F61AC27A8912DDE39C9F1A31A7314286FBC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cMIy.exe

Path C:\Windows\cMIy.exe
Size 2.0MB
SHA256 402da79f3644d5d6f53aeba884c5098f8e520d733473269f666fafdbac16f6f4
MD5 560c97d656f46a16a05d737b3817e0cf
SHA1 a37f3b057458bb9ede004079ba020e5cf84d00ea
SHA512 b6f98bb480db50ff46b78b76d61eb4cca4003601e7f447d816495e0fc786318718757b3414899b582464d94ff05fe90722c50af0d6af419b0ddb9f513421d908
SSDEEP 24576:CKvv16vvBZ4xlcc8G7H4k6SatbguJBXEU:CwcJZwlcc8G7H4kspzJBXEU
TLSH
T1CBA54E79D43729201BDBDA93C71FA652302C72415C99E7CEAC65EC8A69FCB883F15E40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cQYQ.exe

Path C:\Windows\cQYQ.exe
Size 2.0MB
SHA256 04cc407c6f7bd62822963d9fdcffd5bd507495a6e3e8f048887276a20974021d
MD5 7386d6b724b048bcdaa2daee0380eefa
SHA1 7875e5d8913f0411b48e35b2e7634c23e29a4c5f
SHA512 be35236f3d890ff7e52a1f2fded74b6553f73627b557dd80608777c190b6a85f48fa655daa454c88e3e782416acaef93c499dfacd62f9d625db98519d74b182e
SSDEEP 24576:kmGMsMKbVKZo+psL+RoYyKApxj2tUbhZChZLTYaMViQj/:k/MsMKbF+i+qeGLwPY0Qj/
TLSH
T152A5DDF2AA35A427FEC954C86E0D79B52F65E4CD84370CC9C94930287D6C2BDCD2A4B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cUIU.exe

Path C:\Windows\cUIU.exe
Size 1.8MB
SHA256 1c2448c7c472b2088e0c1c28cb5b4157cd4799c88359134df2536a4ea1c0219f
MD5 4d03bc2cd8e40d2bc96e926bdcacc52d
SHA1 f15d65be160a7e4e67a9ee22f719ef7af9c0f635
SHA512 e04fbf1df453c27ad8608a3cd19b6714f3bf07eb70936e61cb902970a813c0009ab120ea2757b6dc7f126c58c045a1e45eb3c08c9f258ca65ec279555b915caf
SSDEEP 24576:UFRJnXf4dTla3zbDnIBOA4x32uRgy1NpbK:UFLnZ3zbDnI6xmwNpG
TLSH
T121850008B732F60E309EBE067A4DADC9AD664F0DD9CE5BD36403B61D784464C263D4EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cUws.exe

Path C:\Windows\cUws.exe
Size 2.0MB
SHA256 fa07499df3b7ef46c46b70f769bef02ef05363a65fe716783f0d5dddbe30a14a
MD5 1d83dfcc1dcd5ebfc38497254d10805b
SHA1 743b6ecb70258ad4f800fa23ec29a2ecce84fb2e
SHA512 7fd5137de239201b481b59d2b62ba10d99ac57aceb914c174fe2a659b75cbcfb375e02a4872e8af076c2ee0caad1dfd25e1027013f6a8b7e7c88afe694787a37
SSDEEP 24576:E34XBnelruF6j2iV+XeMKLXkN+Sh1zCdIT0g7Co4KZiBPf8:EQeFu5K+pkc+S3vog734auM
TLSH
T170A52110D6F922BC118F9325858FDAA64360A72A077D2E1F69ED97D24F34B1FC60463E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccsg.exe

Path C:\Windows\ccsg.exe
Size 1.9MB
SHA256 38ea1c8c112631973f6805f3fb9561ba986c8ffa18930b6293124230b5f641d4
MD5 566de2a8e3ed26bbae921f406f239409
SHA1 90b64f45eb620e1e4fbfe3fe8d7c35b74a2d7789
SHA512 c3916930e10badd174e16bafd442b6898b85547af39dfe9890abf438831309df35572cf81f0ea4784c0b15c249835d61d63eb600b06486f4968ac7575441e8fc
SSDEEP 24576:7kY7sGHGPyYVgeEoSQ2Scj/HwI2nF4dWXMx1lZbyP6iubZQVcHZ:sqPzoL2lPwI2nF4aCZeP6pbuVIZ
TLSH
T18495763A83E2EA5A5635EA4BDDD8C07BC3F67730B54011A7271FF2921E9B27405CB168
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ckkE.exe

Path C:\Windows\ckkE.exe
Size 2.0MB
SHA256 2542b0ad47c041207257f3d68f1fcb72dc69c9df1d439096f40ea263a40d864a
MD5 f8c1ad2ca01206a8ebc0b7c9052ab07a
SHA1 357707a2d8061e087551fb383ac89fe54f018ca5
SHA512 d5a5fe5ff797f9fd7142f43295e99c0925ae3c370a21f4bfc21dd9161ddaf810de33326a15695f64f4b3ee04eb0a2a221c4eaae5b30e77c3c4e385754e5b3e92
SSDEEP 24576:CRqsTsu6sxb6zQtQt71c9qcMotyu2nt7Tj1DtnumalqxEHhU:CRgsxb6zQOtu3MWYntHRD5NalqxE
TLSH
T189A5FB9F4C889C38DB73A1B375126E894BE3EC561602464864CC7479A7B4A17CF2DF2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwUI.exe

Path C:\Windows\cwUI.exe
Size 2.4MB
SHA256 4bbb3aad9d482406815bed5bdf753cc5664ce05acc372a3093aef62631101c4c
MD5 51bb3e8040879c692eb0fadd8706fbd8
SHA1 eb0c4cfa0cb464e56bfb499b1634ba32b9ee352b
SHA512 5181f4125d7f8d7bd5cd96c012b3b754d2e02c5a70c9e630d2651e222d6365bba452fc1add8a26dbbab0e5d7424723dd4a86b2a81c0d2b95caea5cd808c2c85b
SSDEEP 24576:QHaIJOGWTiJv/Fm3F9MfCWw0T9WOfUXVioOlHc/3yEhmEzoAwq3P4yCDvrD6P8Vv:ozns3nMw+1giVHcdhlYq3PXC7P6G
TLSH
T18BB5B591731A837E4BB0274C51239F3EB2E1A8DECFC7818997382579CAF0719CD6585A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eEwu.exe

Path C:\Windows\eEwu.exe
Size 1.6MB
SHA256 dd2cf307bea20ba8d0b1e51836e0851c3cf4871ea7f9338e2dcb61c945afc230
MD5 86cfe0630ea597f0bb2210caa9a87d61
SHA1 82ed4007d2ef910cff4184e68e43c7f6933326ac
SHA512 e8b71aacb660a62af03e3e783291d659220c64daa95d51c0d386cd23f5fc204fd5be33523cc572fb6656d249a9b55beae1e58a58704fe3b427f1b7ce9944c922
SSDEEP 12288:LWEMN+laIUxxXGziTuGNPj4vYfKNgxcBnPSrcMd6LCPDjp1EWEW3NoDi8nw/EJWG:TllaNrjTrNPuNgxcRVMTLXhEWVp7cv
TLSH
T11275CA3F7BEFE85869BD20559E974C184A2530EE4CB67A9B3C1E3D0870B581B276109F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eQMA.exe

Path C:\Windows\eQMA.exe
Size 3.1MB
SHA256 dd74aa59c165ee58220062cb894782ba769698b59c948041d92e4f98acc4509b
MD5 0298ca211958990c75b04ac9c5bdb3ce
SHA1 320f5b847befd809461b5270ba510c385810ea9a
SHA512 26fad211be4bef7edf95fe4346b51252f23a5bf7efa8017667b8b730ffb281a1f26162015246c13d26202f3bec09c1306f75caf2f05d15e0e543090479169b16
SSDEEP 24576:tIOEQvz9FVf9UKUy/ZVgvO/UFczeV0T3paKsEMXqHAmW:Tz9FMdy/ZAO/UFczepKsEuQW
TLSH
T172E5554EFD25F858B1968F30EC94E2B353155518BABE254D50F1778E8883EEEA12C3E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ekQs.exe

Path C:\Windows\ekQs.exe
Size 2.2MB
SHA256 3022f9ed0a24327007e4a2b004228d3106cae9e8fb54222be1a5462ec3605376
MD5 74c13f0ba0bcc8509ef062434e5bd7bb
SHA1 9619937607efe159e86a879637388130e77ac0be
SHA512 0abd2aaf9a175ddcfa03bf56bc72bc8884a291b1c549830f5bbac0375fc50c8c4d93bf0e0c96c74dd8710e9c354056974d3333de303062a88423218c9ac0e4d0
SSDEEP 49152:GV4ANTRuUtPrhtEfzJkEcMrazbtPKlpG4PvNyfghsj:GV4ClaQtP0Nvco
TLSH
T1EEB55F6B2910EB91B0A8F502E257DF5A55EE51D394FB21F859424EB1B2C0D83F10CEBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eycM.ico

Path C:\Windows\eycM.ico
Size 4KB
SHA256 bc4ed7d844af9da0a5d2fe12e8db07fbfdf6e0ecd557223b292bd0e9cb6a64a1
MD5 f23fff4d0a1b8dc313d9ebaeac993643
SHA1 e9e21cdcdd58aa2453f0c73275d5906a1dc11939
SHA512 485082a6b8cc3bd17767e32963291db42367f0982b4f0745d654f084c8ef9058d37dc31e54dc6d58cf23d73d37e73960e5a07c02da5f184e4903d3b989bde678
SSDEEP 96:HnnQTcTvcxPIBfxSQcy3Nk+0cl9/l8KnM:L0eMd
TLSH
T1DB916E63634C2D36FC28A8F5ADA26366415CBF5507E4AC429A7DF42CA43EDC259F4438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gAkm.exe

Path C:\Windows\gAkm.exe
Size 2.0MB
SHA256 ff55bc64fcc8885461a8fa996da9edd3aa53e3331641224ea62e7d94bb46e188
MD5 571c043583fe92906266d5fe87faa3bc
SHA1 1ca9929c4d8483fbdd1beb01296aea35c872e54b
SHA512 07f34eb2d00007109e5121fe397d3fdd50b03112eca91b48f7c6048c50d8532e50ee500dcee9432a83af1c57b3dcea7ceb748503f28882204f0e0cb7e2ee7b0e
SSDEEP 24576:XU2MGJ6COvs+S+pmlKg0/MTCbhsYhXVusbxLvWz6/JZpbNk02r:E2MGPOvsN+7VCCbhsYbxLvDkj
TLSH
T1C5A542ECFAAEE35CCC2595160A2F0B92336E1705B00A5FE360BDE1575A0567704FA1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gYYg.exe

Path C:\Windows\gYYg.exe
Size 2.5MB
SHA256 0f24a83efd82a23bc5a6b80512ae83108341ead0951b8c2dc6b473669ebddadb
MD5 0cc74b8c86464831ca8d0c3f99750382
SHA1 f2c18504358c7145b33a7aa36568e8d50b373b04
SHA512 b81ef845323cc38153e45013784e4601737560416282c6672297585097783cf7daa4db5cf4b225a02fc02e03c1913d4955cdea2ada0481b64690787feae56daf
SSDEEP 49152:2JIJkR/dGMLXohHH/r5Iy6gRZRNjLygFCjb/G:2JIEd1XQfP6gRlejbe
TLSH
T166C5C8E06A040645DFFB111B0F647A4DFF0D86E556891CCAC292AFA32D9AD18CBF0F56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gYgK.exe

Path C:\Windows\gYgK.exe
Size 1.6MB
SHA256 15a0c8661bb5e762c1dac1c7dcff659e38c55297a6b77c6c1696b8506ea86838
MD5 a8aac1e77a6396e5c8be681b40d9594b
SHA1 f4751a0c5661d00872203d84d184870c7b0a3e24
SHA512 82f67458bf6bb465e6a000591c87054eb143df0815bdd29a35d9e5c2e2f9b83f5b85ad8ecbe3e18e68ce5df94bceb82630db199c5570a90e9cd21df977d449a6
SSDEEP 12288:3pkUiQmFHEbagV9kVS34zs0+GVBLlV4Q3jzr53eBQ+lW0N1po7G0UnvOtT8:3pk1NJEboRsYVBLlN3jzr5RGaUnvkT8
TLSH
T1157578AC7B11B48C6407CFDC3D5F539DEE61A5E3947B1F0C8294EA10B6818E674C6BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ggIq.exe

Path C:\Windows\ggIq.exe
Size 1.6MB
SHA256 59cb32e69d887e5b408c3cc3a1d9ab3f828438bc553afb04595965969c74d036
MD5 47de9d796d832902c7736d156d3fd9e2
SHA1 8c42d952dd609e31d802fa0f8e3ee9890730a074
SHA512 a9663617f1e6912699ea8b5d7223d337d18dfc037c10f3ee1be4a6d6523a21ff159940e7458e7868583c9426ad760e7b2615741543a104912831b2002e81d9de
SSDEEP 24576:cRISIlmK2yRjsIzj/UF8HkurbmRjpfvO:0ulHjsIzj/UF8Hkd2
TLSH
T19475FF42AB7342FC942C69236F9B439E03DADCE22441EDA91F11A3D4BC7A4974F78875
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gsMi.exe

Path C:\Windows\gsMi.exe
Size 1.8MB
SHA256 b12e5fa34b6291bec796cc81fd6c260ff5b3ce423eef3f2a72a0100f1ea91b98
MD5 07d0215feac1614cc99ee0547b73d688
SHA1 435916399a5a9310c88eecdfe183b23a0b5e7299
SHA512 cff2f84c3abb1ca0c314218de0eba414f739d69826eed10720aadb91aa6b0ed50c3d7435321c171590bc314c538e561f15b3cc01c2dc91729362ad2c50e7d7de
SSDEEP 12288:bjRZl+eh0hakwEUSJ+4txzO5D/dnF2gr4bibYpgByJmPuJgPZXBLMRGb:3l+eihak0LoxK5D/DWpgBuaZtMR
TLSH
T1BA85D82F2CBB4112FA5E528D8E2D466F6003EDA048493DC1937E1466676B61CDB36FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gsQq.exe

Path C:\Windows\gsQq.exe
Size 4.6MB
SHA256 b4beda69497e196afa03134d176222561adef59f1d7466273a982a0e95839508
MD5 df4329580d7daceaa69b2115dc3a77c7
SHA1 20c0ab41f72f95f5b6b237ace9a40dc41a51018c
SHA512 c5987f582bfdc4d2b38dbb2e6c7e91554171eb277afd0e21a50f2f705922dcfe2871dbcd1c99a1a7bd0df51eda7cf6be6c6494402c4a7140d53ae05a36786506
SSDEEP 98304:kgZctPRNpNibkbbCihYmaa6GnuDAww1TQmH12bDFgtvH4kb:kgZct/Hek/P/MGMAww1TQ61EDFgtvdb
TLSH
T1D42629D1A2A5EFDDF162940B66295887293F05D83B7D61FD906F229B3AFF0770062312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iQwa.exe

Path C:\Windows\iQwa.exe
Size 1.9MB
SHA256 d8efd946d9471a91f76c5b6f25c3c3ebe8a506b07662fbedd71793d1262188fe
MD5 44021eb6b3cbceb3b85a8b7c61e55542
SHA1 2bce09f9df71faedcff3f8b6d97ea5f3c603ac24
SHA512 63c129b21fd20f9dbcd1805151e2ac04b00fb93ec69979b379071489f59aafbecde05257bf380b480b467def387c4ff57f31104fcc199749da3b2953ed50b355
SSDEEP 24576:1H2f4MvlunKIg70RXOjrByrlNvrWaDudLp7Q9P2t0naHk7:bWfb70RXOjreAUuc2GaHk
TLSH
T11995648DBBC5BE2B0DC17B7427D68FF533518B6FF9B5B90E040A329932908B5605096B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icIC.exe

Path C:\Windows\icIC.exe
Size 1.6MB
SHA256 c5c9cc84a69f4cef3e3700f6bc7707e88f06449f4ef49e10528448685a73e074
MD5 08e10db66a4cdbfcb6ed2414b0ec40b7
SHA1 c8040300a37c40c14d1c6764eadf041719f2ee4d
SHA512 e803087488fb7df910de256c6b1cf5c29c975af0684f4f19acf26fefbb880ad61ff6ec0f5946f61db321dd872995b82280174f737dfb8759a94942d954284934
SSDEEP 12288:wpw7UtExvuBfQPIw7pTQfjggggggJXOqMnHHBreqRRVcuIsuUHyBldM2lI03O/8g:+w7jx77cAgyi0yt5CGnHcQKx03BM
TLSH
T11A758B0C894BD770119CF9AE80BF62BAB409571F762B1C3AA033315A71DAFAC55538DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ickK.exe

Path C:\Windows\ickK.exe
Size 1.6MB
SHA256 a33e647317c2e11d8072a4e92ce48af427f629bd8e14bf18e58adfdd01393c23
MD5 760fe300e3598fce8c7979c0c6155909
SHA1 5aad2ea5c3051fdab459fd5337fbc7a6847642b1
SHA512 51ac554598fb2d14ebe9a020673ed559ee4073daeb809f0e2c2c18e3f5d3c02e1d9df9053d24fb739e3c1612fdacfa592aa4e7bc4c3bd85dc3a5f3bedf5a81ac
SSDEEP 24576:YstFqer/qdcnJT7VZDkc52FNWXuQNFP754ZcRd:n0dcJtZAc52Fo3
TLSH
T1D57553642FF3146782EDA3B45064857B5F24082765AE876F98087A77EB2FD2C704F12B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iwgo.exe

Path C:\Windows\iwgo.exe
Size 2.2MB
SHA256 20224496d33216bb3955426fbb846878f0712b72bd592498bb93a4352f222e62
MD5 5436973131e4de8a4eb20cc54bf41674
SHA1 cffd2f04a9d9695f8f6bfafe51e71a3e5f33961d
SHA512 0c4f3854a09c1d2707f152f94fc191c4efe5f28a0c3eda6b04b7d541b8ba37d79f277e1d13b0fa619205fa6afd495f88f70d37e5f214dd5b2c4b3cc36b25ffae
SSDEEP 49152:m0x8s4dbngDKDSpBY2sSE1nh6PwvYyzRmyk:m44ZgD1NEtgoAyzRm
TLSH
T11FB50B1A4CCCC36EC8CD1D2E8987E61902B8CE7ED4DF2D5E2367C926A7D8BD4522D950
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kIIs.exe

Path C:\Windows\kIIs.exe
Size 1.8MB
SHA256 10d75a5317c943d3a0a9565d1baf7caa9398a2fece1afb4cc913122d18bc9f5d
MD5 71b7606fac7b5cf7b6c4a9423968e85a
SHA1 668ab0535ce1f8005d31e817792b03201a6405fc
SHA512 36048404068b2115060fb805f1dbed2b4002bab7e7e211bff9d4be4b22983eddaf151ea27dd4163278bfa7b4561a23b801cf8a4a4f358cc8be8ff7e1b9071396
SSDEEP 24576:lsJ6ZDcwSFLQESe+dvSNsd3Bn4On+xgX9jfqWUB/pg:lsJ6ZwDFUk+dvSNYlPn1/UB/pg
TLSH
T10995C7D69E2D3747E424A33BCA6C318774CB6141751E85A22E725E0C3C599FA81BF23E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kMQW.exe

Path C:\Windows\kMQW.exe
Size 1.6MB
SHA256 f1ed747765691e2df3f9e6119cb429b4d0cc9af8511bc6a773f031dba1fd96ac
MD5 9248e807aacc4a173d8a7c77a74db2e0
SHA1 2df5e72eba650e06db87825bb47389e761405e53
SHA512 2319764cb40cc84e077bf9a6aa4bd50609bc7fce3aaa4cb192ad047b4346d38a2cab0bded467ab13567327209ae43f57d7e50f68d429e7ea8202cf5130c468dc
SSDEEP 24576:F4APCYoYjEqPThpzx5Is6sqol+0mev9I5ay6Ji+3XPmocAGZ2/:F44hFxasUoCetJi+3X1J
TLSH
T17A75689C8C514404C4FD4EE6F4256F6887A949172A9C25D4A2BF0DD3F9CEB24F3BAE18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kMsI.exe

Path C:\Windows\kMsI.exe
Size 1.6MB
SHA256 9c50e138659cacbc351b505bacba9095c0b8321c4873eb11734747a64734e208
MD5 d7ebd42684a2897bb1f4dc4a9799301d
SHA1 9e8cc5cf0c581096ab28a9969b08bdf82ed9e6ed
SHA512 df46a96857465d73c0856662837480b37b984820d4b4bd9b5cea63008b2dbc2225990dc1197499f95d3d3c91542f021d55f2093e5e73f387f1bfd37e34b4d5d7
SSDEEP 24576:1rWbcMF9WOb/fg5oGGZQ0vthCnPoeGpC:9WTb30oGGFh6
TLSH
T131757ABBFBF7911A37F3D8C546835683A3F909A2510792BC07A52FEE44B1809799BD04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kkgq.exe

Path C:\Windows\kkgq.exe
Size 2.4MB
SHA256 487ba0e6bffb62a56ed079afd85915f738260710594240f389aef207122c670c
MD5 5fb61b18507bcea66fd31192558f21ee
SHA1 0a7eaacbd7159a9317d434b82d6bce9400846fff
SHA512 828db0267e1e05d190f7a4fe1ba8e2568da72906c3b55d23f0fdd65ac34f8c760a64f9e1995c2a9437cb872c340f4a8831e9b18265ccdff6c1e46065ca5fd18b
SSDEEP 24576:UlnsTmtqwpZxJtLgU/EbVlj7yWYKihu9dkYHWSfFpcee/tMCM2VMwIUX+RXbzyDZ:U2mtqAZ/tLWHbWSV3bbzWlGtBY
TLSH
T19BC55024E6FA3260997A6AD85D4910DDDE000F411D1C14FD89FCC9CEE6B258D9AFBA0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mAMY.exe

Path C:\Windows\mAMY.exe
Size 1.9MB
SHA256 d33d4a4d643e6b7e457b3209c314bc75a61774747e438c1b6ccd8c6469d76577
MD5 82dbf55447df3acbffb411045fd923d2
SHA1 eacadb1fec15d09a52303d85f5d1af48a5297666
SHA512 b2712185de01fd391f88a408ddf3de7308de063c0174127ae334dc3fb9c226db36fe707beb46e7d72062827c8cf8585006b887bd0398244c66ca9209d5e77c97
SSDEEP 49152:XWWBRccg2jQRp4IHCNHuNf6TM2NSxffRR/Uj/3RfLR4:X3aDEBf9
TLSH
T196954EC1BEC3CE0667E560ED014C93EBB0BE3EB9C67367AD658F2E8048E4491158657E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mIEC.exe

Path C:\Windows\mIEC.exe
Size 1.6MB
SHA256 2e76b1367d5b23ef8f13e7f707d95b7e2d8dd69fb9350d9f1fb3b53028ebdae7
MD5 d4686f76480901d02b2dec21096ccd65
SHA1 5b0328ed1ed1869eeb922382c4fef4b8f2f896c4
SHA512 38d2ccaf3076022c89f4b6b35d0cbd84490626d6ecd0256eccd59417d2bcdcf0778451aca9f0236d9df8df26288ab95ffbe64f82e00384ea4cb429e099b728a4
SSDEEP 12288:kGX2yxADT+tnQ9fTichvzcml3/3vXa5wN2rPopSpCE5NDb1dBm2:kGmymqtQd+chvzvCPosME3b1dB
TLSH
T1D875997B38BFA9209A207BADCE1FF31CAF45146D965AF011993E300EDD61546CA70AF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mUMG.exe

Path C:\Windows\mUMG.exe
Size 1.6MB
SHA256 f536063bc44427364e86f86160d62a5adcb85e55e795e6020bb66326c97d0f12
MD5 0c1836f8f3041b456e66ee694c666648
SHA1 c3cc0dce06a3e9083a7302e733ddcc67a9861896
SHA512 b189a479f4405701022516954fc3176119a7e54e3a36c94bae1674285c7278d157953269b2c7071c1a20003b5acafe58b6ec52f887abb4519db97d2338201499
SSDEEP 12288:7NiWanrDgGairfOhreDOFbfADyubMej4i16fRiVU9DD6dKEDY5VNcb9Y3gSWrT2B:70Wap5BrTBL0ChoqawsDNlVPjCkpZ
TLSH
T16875D99C14D9166795B46E20F2645B0EED3AF4F9AA01DEE0C6C7906EB270E9DC448F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgsM.exe

Path C:\Windows\mgsM.exe
Size 1.8MB
SHA256 bb922faaaed7c1fc5359346a1b2670d28e0fa8aefa26ebeb3768cfc0821e3fbd
MD5 4bf130fb726803a3374a059957d4fcfb
SHA1 fee3bcd060ef8ea0aa04ee846e36d84e99806c0d
SHA512 ec05fd240e613f0b09a1b9db55ffe463e66b83b241265fdb5a8eecc985462cc2ac9abc099b850f20bd33f178662f8a831cc321676510ae55fd1ade93bf5be1dd
SSDEEP 24576:2eymwCvVVVLVVXIVVUVVYGVV4tVVTHVVRXVVfPVV7eVV9dVVq8VVRsVVSjVVM3cO:2eGMtDHXXTjGWZeDugpNivRt5T
TLSH
T18A85EAD985330047956A56D52F7F2BBC3E3426C42039C8E6D4BB3D21EE5B950EBE6883
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

moMS.exe

Path C:\Windows\moMS.exe
Size 1.9MB
SHA256 6a684389bb7857b21e8824b8071abcfbdd7857bef07abe19deac04d3463065a1
MD5 4de09df1ee0cfc03a23f8cd84e6cb1c1
SHA1 444617837c59b40301bf202f8360c6b0185936cf
SHA512 4ad4296a599a206d7b78159826162fd5e3f4b01be9fd5278cc6590a34261ca2759c2531f0410f4fbdd06623256321567769c98679917f855d613a6489c7be0d9
SSDEEP 24576:8gArVNJhXQ9UGi5a7g5TrjEDe+zIdabiPoQ/NKeqk/q7:8VRFBQ0GIdauPoQ/NKxR
TLSH
T1B895C9EC6D9A29058ED31D1E39450AE83CADB6150BE3D07FCFD07CA878F6B6109651CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

moQg.ico

Path C:\Windows\moQg.ico
Size 4KB
SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
MD5 6e9325e46193ec554308cdb9ec8a9cd5
SHA1 3e3c4a52ed1fd3a85f8ab172108c8fb61e45f70c
SHA512 071ece6913f89a4b1634daa9d650bfa8f9f406719c124a3819cbdd3cb617af419abc6010283dbb510891e9744ce03cadcceea7b137395c538f42df838b1f6322
SSDEEP 96:5wwwwww6W/rQPIEXv6KvzVqzd4sJvbZwwl/j+jNj2jly9:NQrXvfzwzRu
TLSH
T1C4911623531D1CB9FD2405F1ACF89A75A59CBA0153C63C642DEEF80F69AE8C69AF2444
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mwMs.exe

Path C:\Windows\mwMs.exe
Size 2.2MB
SHA256 d9ad69eee05e732ea89142e3d35c3a8878fc9558fca21a46a6e7a65d9c79bd83
MD5 7ac1cf2d45dc6e79663c883427f432c9
SHA1 7ad49cf6e0539deb710f5a6778978bf4d9d9d2bb
SHA512 1487c073a3242f0e28d68649bacfa919fb4f665a58cedba76e133add897a7bb39f51d08534f12fbde95b65975d45e36a078c0a8b756c2ec2113e9e12b679b214
SSDEEP 49152:u21fN2yJrcoylmsY4RBQ+W58Uh3N0xccEi76LNpVPaLLLaQB1+pplahmEtfRJlWr:fFTYHjlW
TLSH
T196B5B91CC05376CFB7A7B2D80F6C23B8B2CEA28A55CF3681FB8094A4D24953956467D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mwsk.exe

Path C:\Windows\mwsk.exe
Size 2.6MB
SHA256 a72cfa05680264b20b1cefe6e4d7ef7722f16ede517c9958ed9aefb1dae9c4e8
MD5 4d43b92beb440e60b73909a5602bdef9
SHA1 1dddcb6935e51e14985d0e3ab30c7eb7dc039b49
SHA512 0d1204f6cb7cba11adc1dfbed021f54dda73fa259f997ef5170e101ae3ad7e78f783e84cd1a6ff188549f114dca25a00ba9f6d81d43977449233dc5f69f88126
SSDEEP 49152:dniER6b07n88oQSDd6Bo9HhcktZe9YUzxR:Zt6b07nBAD5dtZiJT
TLSH
T13AC5B47E4E31B17787C747A44E7D44E85AC13B9B6322217A64E3F254A1313AA4F87A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oAAK.exe

Path C:\Windows\oAAK.exe
Size 2.1MB
SHA256 78514d96f90852b5b3e2bcf690ff6206874bbcc2a9a9521e3073a130aa3b7947
MD5 ab4813828919676547b56f369c022b17
SHA1 947b57aa0925f72530e6972aaedd378bf5258d3b
SHA512 6b34556cb5ce33675ed6ac9e34221fd3a717f3821be5885813bc6efaca7f39c66fee8d9b9cd2c9dc0255d12d95c919db7c83a2094aca3f9b974fb632c4dbb778
SSDEEP 24576:iqmT34INAKEQhSEZbCCWS2icWp/kfphDNudtqHzaWln0EQ:8T34UAnQUCD2i7pann0N
TLSH
T195A562F44DE29A6E4C107547BC2BEC36729C353E45C0FB4D48785B65BEBA9AC1602FA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oAcE.exe

Path C:\Windows\oAcE.exe
Size 1.7MB
SHA256 de85eb4a2576a1299d740a44870927269b3bd9e07f2bbb9410656de03d0ceeb0
MD5 e01f1c241051519861d37b6161f46ae9
SHA1 497292fe4e9f7561825e069e646e1adfc3f000e6
SHA512 292d211535bb3bf0959a49f0ec89f3c4abde750c60f758c2c396b38dc50d5490c0743b9c4f3e4f460cc96b2eeeba46121c4f1299e911254c2e1e0bce645133d4
SSDEEP 12288:ryHYpo56U00kT21y2YI41NtQol3dMDgsa06TYBJ+zPk+A92vbrs2SY6Bcud398u:rSYpo56U00kXvNtJ7wCPU2ThSiu0u
TLSH
T1FB85B9D4D74D8AD694E3D0F16895BF90F650C9876CCA3E37A7003202AD2AB1D22FD95B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oYEu.exe

Path C:\Windows\oYEu.exe
Size 1.6MB
SHA256 9b57191a4b5327cd1a04708a48e60c423dfc52d026fa5336cfb9c858005e9c48
MD5 1de07b907594882c37e8dfe2aad8bf7e
SHA1 22c8f6db93ff77e6790bf6316edac46b22ab8f0e
SHA512 d49fa23953d04024dfc6f9da592219468265c47ca37dd7c37a967602b358015a00540360806fb58a56a1ba9bfc3b2e06482ec763e4e9046071c34609ff6e8483
SSDEEP 24576:NEZcvKBQOM5ytKBxYQpvAL3Gj1GFmsDUD2yP:NEZQOZtKBxYQpeM1HiyP
TLSH
T13675CB06D09DEB62DF30C946E10C962E6BEF65996D15F9CF8A7CA015A03FD82EF71090
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ogko.exe

Path C:\Windows\ogko.exe
Size 3.5MB
SHA256 b2dcf28643da6d52f49df42bc4ab1f0e6cc630e25db20bf98c2fa82a96b2a2d6
MD5 be40970d98c5e40b19fb40d093103e2b
SHA1 56eb82ca85e735410aee1f35443bec499f4f2fbf
SHA512 f71e5d5115d42257333d19e49625d54e0e6e1622c864a21479cbc80dd7b1e4eac7b0c69afaa509b92b980cbbf0e9e7aab0f3a37f0ed8e8be01560ef35452cd1c
SSDEEP 49152:m2hkApWeWrED894Qd0y2TdVRyb53BEy85yJ8lPgM91QXojkuIihS0bO:pqAQFEItmc1xENll4MIYFfl
TLSH
T1B5F5188CCD3B82E9F99C0E10F8D3AE29A7B5972BDFF079514C953E5A6DCA31519E8001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osIM.exe

Path C:\Windows\osIM.exe
Size 1.8MB
SHA256 99b112858886a24777aa086542a8823987967cd2c38f277685216327d4eae3f5
MD5 f25a419508ffdbd56bd30836b17d7952
SHA1 fa12d2d3358cdec3ad64c776616bf036cd899ccc
SHA512 05c0707fca10c016ef239392460439da5d5960bf074c4372beca19854d0bc2e44841891f671fb0702f8916e229cc81706ee141b33eefc48a316981609e7e05d5
SSDEEP 24576:3tNs9k49QlBBRkH48hWNvTbGfbZ75hj6iV1sI3M7ekNGFk/:k9DEFkdWN7qf56iV1S7ekNG
TLSH
T1369530ADC258C53149C62E0FA715BAD4F8BDF1544CC075D2A4E63A8AD5E3F72ACCB848
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ossG.exe

Path C:\Windows\ossG.exe
Size 1.6MB
SHA256 ab6d674f34f7aaab5fe4d05d0728b395c893147ea8333cf55d7f02f2d9f8c249
MD5 f433d5c5dd865298f8c382560b045737
SHA1 7c7b3eff5f3a3481f7e818d5daeaa8dbaa4fe77e
SHA512 ddaa68c0debe37056a4f978459dbf92fd763e241b9dce3f1beb82fac3ea4e84103eb3b86d17a8f5bb3aa60139e02dba143be15f7811d74346ba73480b838ffe7
SSDEEP 24576:e7+LBGjR+CKvbQhaQLqD0pjjSEocOBjV:e7oBxLfD0BjSXcOB
TLSH
T12E75795D7D809D75228BD31BD28A22CD24F27BB4ED23ACD22C5EBDAD2504205F51EB1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qcMo.exe

Path C:\Windows\qcMo.exe
Size 1.9MB
SHA256 0e6e31daeba783bbed7d9bf241967ae7878daa6e307d227f4f3b72cbebffef6b
MD5 9788ef2c5fd5c09ad97eb84b5caee6dc
SHA1 8e4415e041b0600073f329e5db9c50692256b7c6
SHA512 f45e5d12251f25c93f5aadbe757037e4cf3cc2de67cb9bcf808a13230370844f4f28ed12c6ee27f63c50abb030d0f97fc52c110b01c597e595c2563624782af8
SSDEEP 24576:Ydk2jYdXnWXW7WA/fpht9SZD7X5sUsuajBTOUT68dTP:Sk4Yd3WXGt9SZD7uUsuI
TLSH
T16295FC136C59808003DAEFE542E990FD6F669CB99AD716A3A7468BC44F4CC17DBA30DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qgcg.exe

Path C:\Windows\qgcg.exe
Size 2.0MB
SHA256 f11cf966820d3fe6dc9e3c7b229740464c3e5042f44898c9b743923aadde7537
MD5 26dc5f72f5aef581befe3b467ba09487
SHA1 4ec2132251b096b673bfd058c71011d0fe49d35b
SHA512 dbc51836128c4c081f95c15aedefd42fb867b11a469050540ec750662e3367b796a594da4e1b0c2692811c6d854f6fa0afeedfa6febed53c248e044779b80e50
SSDEEP 24576:YpGqFJF3kuZbuoYo0dTyNATpDWzgmgw7VWvjjwZ+XYnDTNTB3VokkW:Y5AucSKSgyWvnwZ+XYDTNdFo
TLSH
T1A9A533BE870FD1C48B829AFDB97C81A406BF768BD1E34240FAC4D6479F6C36B5588056
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sUYs.exe

Path C:\Windows\sUYs.exe
Size 1.6MB
SHA256 93f75807f4d9584c687d6f435c35d67c90b250ab9858f0158c19286f0ce9666b
MD5 6996dce9615ad4605e5e81db04314f00
SHA1 1280439a217dcfc2026152ae193eb4b7e31c512f
SHA512 035fe37fcf1394dd9cc1b60459a4c4af2ba5370d95c5e92873ef907420875d8d6f3feed6f65e4205df0e497dd109304266dbefcb6c63d66cb018fdf1639da7ef
SSDEEP 12288:Q8nKDxa/HxWhKoU6JPv7X2K7qRbb35Nuds20cYtN+8fhwJ3Ck2AgQvyWGL6sM33B:Q8Elat35Nuds207NVhPkHb+C3seXb
TLSH
T19775A15729AB6804873F14FFC0A85D38481289B32E893D57C7ACE5DDD0C746BA66723B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sYQu.exe

Path C:\Windows\sYQu.exe
Size 1.6MB
SHA256 f1363d42bddc199d03d6766d8951395583a59d47208eec584293ef0fd9d9e361
MD5 f0ecb5af6c0abcf3ce0e611fc24a9d93
SHA1 deda1a5010e79fa6138ed3a0b0b415abc1e8ea0e
SHA512 53c76ce306a4eecb4f894906800ab2e40b811b7f85a567f886805e32a83a9b602af44cfd70960a5c57c6e9b0601cf0839cb5792f07d76691fb8d7170e2981601
SSDEEP 24576:3cQGVm/lXVicS6FxWKGQ4fsv00HilQWcb:sQGI/lli1aWq4KR
TLSH
T1E1755173A5E700C48DFD7BFBA1186290A199D60EC3C0F164E837ED974A74A616F086ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scgU.exe

Path C:\Windows\scgU.exe
Size 2.0MB
SHA256 721fdfa1882bf603370df5c3536f9cb10ab5e013fea6b04cca0ee137974da5e8
MD5 03ddc767d2309ce4d06f418123f3be08
SHA1 08673cd1db8646409d2ae0834298a64be31b8080
SHA512 89d8aef86979dbec0a809d6d522eaeeaf1be767392242c265123d76a647416d68ebb3c92acc4e943445500aefd8b786a64432ec7ae862171ba7dc3d16b1be164
SSDEEP 49152:8kr3HdHyLnXIGq9bRi0bj8isTSlWgRtRvN:8ydHyLn4GaR1jGTSlWwtR
TLSH
T131A594D3E16F14D6E860A5C2D43321227B7AA82AFE3376F217FA0E50ED3C5AD69145C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sgwk.exe

Path C:\Windows\sgwk.exe
Size 2.0MB
SHA256 59fee3cbe3c862ecbbc611a42ca7d4888bec9d7a10728cf928f65f2b0a6b5105
MD5 70b217e1d2c6802aa454b4d36c89a881
SHA1 48753617a8ae0342e6f5f0bb29ac2f73e0cf9417
SHA512 7ca1625495ec7356cc2dd144c313767827cabfc1f79ab5dd6834a30bcd05ed6054463bd5a8614d6d80c618fc85b77ad1978331c1c852056da50dec3a10fa49fd
SSDEEP 24576:Hgkns0qMPYOGumpfu+JMP+KGZPXUreKNXyfi8WTxxvCEO:Akn7qQxmpf3KRTx9CE
TLSH
T172A54FC425E6E6B586C83B718528E6A9DDF3967C4E9DF3F229443D7548F03888C48B87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uEcy.exe

Path C:\Windows\uEcy.exe
Size 1.8MB
SHA256 19cbfc0198fa254a165dea3e5a72a0fdfaf8e261bb6e19f5e226d7f9d7048be8
MD5 67438c25de3aa14b1663b8b706a7460c
SHA1 e0113c4a9ffbf61d41e52120fa56ef672ebcf61d
SHA512 c9e9dd17cf4b0fb65811c303ac0b229b2bc6f7a5f7e90bf432700487c7ac990e1182ee2185928555850894c3921e429909f14339d50b06fc73d2cae785741e32
SSDEEP 24576:FvGGOioGYuofghMXXoLr2DZQ0+RG6pTL7UyRHFCQu0HebC6:xYXo2noLr2FQ0YNfU
TLSH
T1EE95EBD395FF6A21C91CF87A43FCB1D9432ED9158658F87592FCEE79E94A502838808C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uIIq.exe

Path C:\Windows\uIIq.exe
Size 1.8MB
SHA256 39fabb8ac8e5818fb244bb425a37264af477aa1bf52475be8706da5d0914565e
MD5 6bacefd956c68e97659de8dfeb2201bc
SHA1 bc8e1fdaea0238474cc5c2fae99ffea771e798a0
SHA512 e5c37bb6e3f6b403f7b3d0cb09c2066bfa5b8ee0ba4fba62d07275c679d89aae625f723b50116a97d7d1781d7bcbe075c6d29c201451247ff8fb033af8068685
SSDEEP 12288:eyy9AWnQqxyOFL/63sSWSx8MZkr03b88pVSV8kJkgNyRa90EpLHJEWf+HU5igCey:CG1O56cSWSiYb82VSikH8AiITdf2UA
TLSH
T16B950AC9EEF0DE164E9508F199B6A3AE8571CD65F79098640CA9F030079DE4E3E7E8C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uoQi.exe

Path C:\Windows\uoQi.exe
Size 1.9MB
SHA256 45fa1d87f5c88fc24941b43851d1e2d415c4b3f039fde148a2cadfbd2f10c719
MD5 441182ac3bff760db8fab47442a73e3b
SHA1 cc9da09deeac94ab19210fa94badffe5205f5fcb
SHA512 b4a68fc921dfd38a9aed4b36d160986c7870dc4e10369b117c9b54a0bc33348c5522571e3a1cb6e1a593cd0021a7860ce235a021dfb85a6868e721870c3f66b0
SSDEEP 12288:lLTJ7E40SLCDzm915mQVKk+o31lOKe5AYwLMgzEKcJvRRnyo:Vi4MW5HK0317Y6HzEKcco
TLSH
T15D95FBC6FF5550A6C642C1FB873CDA99DCC3F45DAA9145AC4D4C29F80A225A3ACCECC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uogI.exe

Path C:\Windows\uogI.exe
Size 2.1MB
SHA256 54c892a2bb0ff7dc95241164ff8197308cc520fff78afc40fff67e167b49f32a
MD5 9dd2329cd8e68be15a6aad15498aa03d
SHA1 1ec71b73f502511472fd2e0e1389d833f1a61af0
SHA512 c77b7e97ccfe74833701ba2ece3117a415bca8c2b40d4ae7175d462e08b1fd46e256045e0e06125fd4aa2820139609a040da6d366ba6410f124af03891016fd5
SSDEEP 24576:Mp6sbymVH8LN+J047VD6DazAGOuxIxupFFu/EldMJ27adHTh:peyq8LNwNAGBIxuCXJTd
TLSH
T126A533D3EA8B71EB0661B0FF20B0B6F10993572990CE5549C74337A5DD9AD6C289E332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uwEy.exe

Path C:\Windows\uwEy.exe
Size 2.2MB
SHA256 e0739b2d137debc3bf0de525a5741f9dfede571f58770cfb17fdf01591f295d0
MD5 1a8ec8aa79c37fd824ac0a8fa366e15c
SHA1 e543b9e2462242aa43392071392e22e0961e85a5
SHA512 2de74b35bc827214a8fe29feec0fbd342b4e30c0c4273b9607d5633e5d262fe32e8282192acd2c293d9493c14e29e84632136c32453f111d5506046590f7aeb5
SSDEEP 24576:lKUTo4cuMFicaCd+klNfatrl4zsRZ1+4/K9Jk4:lKTfFich+kl3zsRZ1+N
TLSH
T1A3A50AB615AE836D493BCE1DCEB0536CC1B3D8E73DA1C36262553C85A928C2D6DFC864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wEoG.exe

Path C:\Windows\wEoG.exe
Size 2.0MB
SHA256 d05ce1b1adb538c2386b85452b3d46026b4010d9269ed3eb0b0ff91951482a78
MD5 0e461f92eb09b4efab5bcd01d8f8d0f9
SHA1 744328c5c97d5eef67c93cf3870e223d8947082c
SHA512 bd7c541be9c2c18d5704d10da427e541b78edcc0644b3c74988e3e98fbfcf79f3e72fe2c0e5047a2c340e160a11c14a84ba423336c3a99ad299dcee621dc915c
SSDEEP 24576:h/YMmTtxOpnzi+ZrwOkodrBp54vTTNz1D8YlUrseVH/6Mom:hRpne+OOkSrBp54x1D8Ylqsq/0m
TLSH
T1E0A52E472B23A27140DE1EE260CEC89DDB5E569F20C663A0311862EF5F66CC9CDD4E97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wEos.ico

Path C:\Windows\wEos.ico
Size 4KB
SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
MD5 ac4b56cc5c5e71c3bb226181418fd891
SHA1 e62149df7a7d31a7777cae68822e4d0eaba2199d
SHA512 a8136ef9245c8a03a155d831ed9b9d5b126f160cdf3da3214850305d726d5d511145e0c83b817ca1ac7b10abccb47729624867d48fede0c46da06f4ac50cf998
SSDEEP 24:su1Flj/XygwYAaMiM1E2/pkQ14btLH3RJigg1Kjq:vFlj/XygFA28BRkI4btLHhJigg1Kjq
TLSH
T1579127351B08C4E4EC5AA53182A706F708AD2CC3D1B4D47B52F07D7EAF33B72691166A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwok.exe

Path C:\Windows\wwok.exe
Size 2.1MB
SHA256 9013053038e13a77dc30441443a664ddfa31fece315f6dab5cfd4c76f7e00ac4
MD5 0896559e563d02440503461622da2337
SHA1 b2d2b953e922f695157ec5048fb569172ccf6591
SHA512 c39bb63cc3b5ae228828219d5cce1babfde5c4449a0c5bcec4116a62f1fcf81e29368995f67f0c84b393d92f34493847a017209042a932c747480715ebe4119f
SSDEEP 24576:DLfvruVEDHvalBxJZh81PRdbUCJOPxhphy1kPu5pjBG85:vCVsHOxK1ProHPxRqk2Nv
TLSH
T1D1A50F5C09B87CBB6A9A4BD25CB7CE7478C5AF0FBD778ED4891D420389664A00598FC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yEUc.exe

Path C:\Windows\yEUc.exe
Size 1.9MB
SHA256 eddbcb8ddce81ab7690bcbefc0703a7d37ea9b362556d560b148d5e708e714e8
MD5 1f0148003cd7cad498d0760acc5e1d06
SHA1 1522b4a41471d865af1b78f2e318516ecf623cbd
SHA512 3588fd3d71445d88185e9d6eda614b41544139216b0c6683a51434ae943eab0be18d50300f459c9db930a3a96613f0bbe8229ef2822c5d912a6d6e4e3238cfb4
SSDEEP 24576:Dwxp9b0VEEcsFYM3cA343RaCBb/ebx0IUy3btvSyzi:Ib0VELsFYM3cA3430g6biIncQ
TLSH
T103952DF72FAAE2D854C3CE79164624053526957CD03C6BBAF45E93D067B23B25CC3A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yIou.exe

Path C:\Windows\yIou.exe
Size 2.2MB
SHA256 9088c0c1dfbfb2418b63349978be58ec45c4b3b205b541d33876f39de8dde75e
MD5 41a86e0aa7c17dca03ca9f185304face
SHA1 4053b9565da30786c07c8bb9b4c760ab6fc3f3ed
SHA512 00351fb68db45bd673ed77eb59a0b26be6f786306dc345a2bf57c276453e488a6cda4a54aafa0e4a461aff13406a923825d7393a055073d810fd6f952e655e7b
SSDEEP 24576:x4PwnrWM4yKe/0W3fqhHpNcdsN067HebfLnxKN3aOf59blKrorv:WInrZhKc0W3yhJNcdqpjebzO3dXblX
TLSH
T1CEB51C69FFCF04581B97D7BBEB07CAB5DA42AC3A608F06129281D3C02775A74CD5A49C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yUAu.exe

Path C:\Windows\yUAu.exe
Size 2.3MB
SHA256 57302ea8ebb838c25e3fb8a0c5de7163b228ec4f7cec35f2c8722ecb6f3ce9dd
MD5 13acc073498b204c190cfd93462aded8
SHA1 1c888699d67ba5823887a485b25748de2cc33cbd
SHA512 6dd3330ec7c91c133ea5196cce1ac4ecc191a87b91980de1be277d201bda81d9f6d63e24bb00875f79233ce8f7db63518a16b91e483de5d655dd1e064deef77f
SSDEEP 49152:OTB0gTROTFEcVg71br3SnNqqbDnY5XQa:OTB0gTROCcm71r3SNqynY5XX
TLSH
T174B57F4E0E212BDA853850F9390ED6787DD2AEC5E0232D6A157A5CB0C83F7B828DDD57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yUsE.exe

Path C:\Windows\yUsE.exe
Size 1.9MB
SHA256 3459e718df33df94bc5ee71a21f0a0fb1383287c5b0a958ebbc65eb6d21ac431
MD5 fa88565832eb58681b8bfda4648615b3
SHA1 87323219f444da8d917fe4ff2added7aff84f5e9
SHA512 20d4b9815f4b12cd7e6060428037022eef96d6c61f318ba99297037ce7b14c634b10e7ab75e07a19234cc41edde0dd916c107069ff22fb818b067ba58719ec6d
SSDEEP 12288:HMJKFbIArkHWtc87t4jCMKppnY9XB083ZItXxG7nu0uSG2/T/OSzCv480fVxSIPl:7b2Yht4jCvC32xxGajC1tXrSIWG
TLSH
T15895EB5A8CE107208FCDE4B51CDE1878CE77567081A9F9C8476A2CFD98D76768C602EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ycsI.ico

Path C:\Windows\ycsI.ico
Size 4KB
SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
MD5 2fb613374fd9eef57a03c8a2d2e52d8e
SHA1 345eae2c0189099b5367e22315b663fe6d037232
SHA512 74ed79d3db6211b1bbec4ca6003fecc866d84abb38987fe4a442558a520490797bf0b54c643b6b4bfc687b3be56d011e204d89166cad33174df82a86fb036f99
SSDEEP 96:xguRJDhHREoYxoJooz1oj8vJBI+L6Y1X4Ni:xgZb+Hz1FaI
TLSH
T14291E5E8D341C55FE0E98B77C2360C77E2ABDC6E8A79896E024C31D27E31643196690B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yssK.exe

Path C:\Windows\yssK.exe
Size 1.6MB
SHA256 3c8a76c76c9700a2ececd32035eba6507a1119db10f8e98bfd9ed74064be3d2e
MD5 a078b8639a9baec2a5e1593b69065e21
SHA1 246d97cf856d34b37325412d408aca17ee9f13c3
SHA512 ef416e1945f292b48c6dd8d95dfc8bb5a3edfc093263938929789c50acbe9620c247ddd0daf4f79b0ce83c36ce2bfcaf1f3f4242ac0912ee0e94fc806fc25ec0
SSDEEP 12288:0ZQ/vmsMwHMhNbLKOO+Y1AnjcePZzNfBTALhxtqhC2LCNdUDSKlSLxM8KhO9/Obh:0ZQVO+V+RjBPdX2PqhCESSELl9SLvl
TLSH
T1C17588EBE5C4E05EA9884CF2FCCC6875D6B8BF576BAC7072F40184D56FD58086803AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/892-200-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/1068-96-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/1436-187-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/2332-269-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/2500-49-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/2584-172-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/2632-84-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/2692-7-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/2692-1744-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/2792-112-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/2976-248-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/3352-60-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/3436-34-0x0000000000A90000-0x0000000000AB0000-memory.dmp

Download

memory/3436-33-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/3436-0-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/3436-1-0x0000000000A90000-0x0000000000AB0000-memory.dmp

Download

memory/3444-227-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/4140-217-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/4160-239-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/4340-1763-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/4576-160-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/4776-1768-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/4880-22-0x0000000000400000-0x0000000000591000-memory.dmp

Download

memory/4880-1754-0x0000000000400000-0x0000000000591000-memory.dmp

Download

memory/4940-128-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/5464-16-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/5464-1749-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/6000-140-0x0000000000400000-0x000000000059C000-memory.dmp

Download