nabucur | afcb8afa92816d7f36a71702d117b908eb932222b9c8517e19f9fe6699bd90c5

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
Size 1.6MB
Sample260808-d56thsswdw
SHA256 afcb8afa92816d7f36a71702d117b908eb932222b9c8517e19f9fe6699bd90c5
MD5 519410c8a6539ac48928f374cf619be8
SHA1 890e7045302b7f3cbf8bf60e63541f21a47c4bd5
SHA512 4acff25b0d7622778c0e25915f643dd6d723cf36f8de68ea0bde13fd18be68c522641f44ddd91f86e7a5fd953b330d212122862fcf64309bca025b8144d3af18
SSDEEP 24576:gwT20C6Lc7KJZ/RwDO6xHS1ueh9RboHJA7GnluZdWz1szH0Aqg8yArhyujoDO/Wj:s6LBJIWHRboqq4Z+s0rhPyO+fyR7q
TLSH
T1E175A938EB391E2E55504EE39CF227BA74AE3C74571BB7A5235CE11CBC80C92FA105A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution nabucur persistence ransomware spyware stealer trojan

Malware Config

Signatures

Family: Nabucur
Nabucur is a ransomware first seen in 2015.
ransomware nabucur

Modifies visibility of file extensions in Explorer 2 TTPs 22 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe

UAC bypass 3 TTPs 22 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Renames multiple (116) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 5 IoCs

pid	Process
5656	FwAwocws.exe
5272	PcIEMwQA.exe
4128	gGYscEgU.exe
472	FwAwocws.exe
1988	PcIEMwQA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\FwAwocws.exe = "C:\\Users\\Admin\\LEkEYcYc\\FwAwocws.exe"	FwAwocws.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PcIEMwQA.exe = "C:\\ProgramData\\OggcIssY\\PcIEMwQA.exe"	gGYscEgU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PcIEMwQA.exe = "C:\\ProgramData\\OggcIssY\\PcIEMwQA.exe"	PcIEMwQA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\FwAwocws.exe = "C:\\Users\\Admin\\LEkEYcYc\\FwAwocws.exe"	FwAwocws.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PcIEMwQA.exe = "C:\\ProgramData\\OggcIssY\\PcIEMwQA.exe"	PcIEMwQA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\FwAwocws.exe = "C:\\Users\\Admin\\LEkEYcYc\\FwAwocws.exe"	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PcIEMwQA.exe = "C:\\ProgramData\\OggcIssY\\PcIEMwQA.exe"	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\LEkEYcYc	gGYscEgU.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\LEkEYcYc\FwAwocws	gGYscEgU.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 22 IoCs

execution

Visual Basic

T1059.005

pid	Process
5700	cscript.exe
4980	cscript.exe
3240	cscript.exe
5052	cscript.exe
3856	cscript.exe
6068	cscript.exe
5092	cscript.exe
5068	cscript.exe
4576	cscript.exe
2040	cscript.exe
4648	cscript.exe
4496	cscript.exe
4164	cscript.exe
3212	cscript.exe
5940	cscript.exe
4060	cscript.exe
5860	cscript.exe
3896	cscript.exe
2492	cscript.exe
4488	cscript.exe
2836	cscript.exe
3440	cscript.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\EYsS.exe	FwAwocws.exe
File opened for modification	C:\Windows\qsIG.exe	FwAwocws.exe
File created	C:\Windows\ckoE.exe	FwAwocws.exe
File created	C:\Windows\Igwu.exe	FwAwocws.exe
File opened for modification	C:\Windows\AwkO.exe	FwAwocws.exe
File opened for modification	C:\Windows\gwow.exe	FwAwocws.exe
File created	C:\Windows\gkME.exe	FwAwocws.exe
File opened for modification	C:\Windows\UAIo.ico	FwAwocws.exe
File opened for modification	C:\Windows\kqwQ.ico	FwAwocws.exe
File created	C:\Windows\MEEg.exe	FwAwocws.exe
File opened for modification	C:\Windows\CgoQ.ico	FwAwocws.exe
File opened for modification	C:\Windows\AAQm.exe	FwAwocws.exe
File opened for modification	C:\Windows\UMAE.ico	FwAwocws.exe
File opened for modification	C:\Windows\gkME.exe	FwAwocws.exe
File opened for modification	C:\Windows\KMIG.exe	FwAwocws.exe
File created	C:\Windows\YQMS.exe	FwAwocws.exe
File created	C:\Windows\ekQc.exe	FwAwocws.exe
File opened for modification	C:\Windows\OSoA.ico	FwAwocws.exe
File opened for modification	C:\Windows\IYYG.exe	FwAwocws.exe
File created	C:\Windows\KoMG.exe	FwAwocws.exe
File opened for modification	C:\Windows\QkoU.ico	FwAwocws.exe
File opened for modification	C:\Windows\uAUw.ico	FwAwocws.exe
File opened for modification	C:\Windows\AYUq.exe	FwAwocws.exe
File opened for modification	C:\Windows\MkoI.exe	FwAwocws.exe
File opened for modification	C:\Windows\qEoy.exe	FwAwocws.exe
File opened for modification	C:\Windows\UQIq.exe	FwAwocws.exe
File created	C:\Windows\qcso.exe	FwAwocws.exe
File created	C:\Windows\uIIu.exe	FwAwocws.exe
File opened for modification	C:\Windows\cakU.ico	FwAwocws.exe
File opened for modification	C:\Windows\YIMc.exe	FwAwocws.exe
File opened for modification	C:\Windows\AUgA.exe	FwAwocws.exe
File opened for modification	C:\Windows\YOAg.ico	FwAwocws.exe
File opened for modification	C:\Windows\CuMg.ico	FwAwocws.exe
File opened for modification	C:\Windows\oksg.ico	FwAwocws.exe
File created	C:\Windows\aMQu.exe	FwAwocws.exe
File opened for modification	C:\Windows\akYA.exe	FwAwocws.exe
File created	C:\Windows\IYYG.exe	FwAwocws.exe
File opened for modification	C:\Windows\GwcI.ico	FwAwocws.exe
File opened for modification	C:\Windows\GQkQ.exe	FwAwocws.exe
File opened for modification	C:\Windows\qIYE.exe	FwAwocws.exe
File opened for modification	C:\Windows\Gscg.ico	FwAwocws.exe
File opened for modification	C:\Windows\OMQg.exe	FwAwocws.exe
File opened for modification	C:\Windows\ceww.ico	FwAwocws.exe
File opened for modification	C:\Windows\YwwC.exe	FwAwocws.exe
File opened for modification	C:\Windows\WEUW.exe	FwAwocws.exe
File opened for modification	C:\Windows\Goko.exe	FwAwocws.exe
File created	C:\Windows\AEAc.exe	FwAwocws.exe
File opened for modification	C:\Windows\gkAc.exe	FwAwocws.exe
File opened for modification	C:\Windows\QswK.exe	FwAwocws.exe
File created	C:\Windows\okQq.exe	FwAwocws.exe
File created	C:\Windows\esso.exe	FwAwocws.exe
File opened for modification	C:\Windows\ecwA.exe	FwAwocws.exe
File created	C:\Windows\QswK.exe	FwAwocws.exe
File opened for modification	C:\Windows\AWQY.ico	FwAwocws.exe
File opened for modification	C:\Windows\okQq.exe	FwAwocws.exe
File opened for modification	C:\Windows\IEUa.exe	FwAwocws.exe
File opened for modification	C:\Windows\SYIS.exe	FwAwocws.exe
File opened for modification	C:\Windows\EYsS.exe	FwAwocws.exe
File created	C:\Windows\ugca.exe	FwAwocws.exe
File created	C:\Windows\Gogq.exe	FwAwocws.exe
File created	C:\Windows\IoQO.exe	FwAwocws.exe
File opened for modification	C:\Windows\uYkk.ico	FwAwocws.exe
File opened for modification	C:\Windows\mqoU.ico	FwAwocws.exe
File created	C:\Windows\Goko.exe	FwAwocws.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 44 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2700	cmd.exe
5560	cmd.exe
4920	cmd.exe
5268	cmd.exe
1556	cmd.exe
4772	cmd.exe
6060	cmd.exe
1516	cmd.exe
792	cmd.exe
5684	cmd.exe
1720	cmd.exe
4976	cmd.exe
3524	cmd.exe
3028	cmd.exe
2500	cmd.exe
3340	cmd.exe
3052	cmd.exe
2812	cmd.exe
4756	cmd.exe
5700	cmd.exe
1896	cmd.exe
2796	cmd.exe
5936	cmd.exe
5820	cmd.exe
3300	cmd.exe
4240	cmd.exe
6124	cmd.exe
2344	cmd.exe
5636	cmd.exe
6136	cmd.exe
4928	cmd.exe
2804	cmd.exe
4188	cmd.exe
6004	cmd.exe
3508	cmd.exe
2552	cmd.exe
2084	cmd.exe
4960	cmd.exe
2868	cmd.exe
1616	cmd.exe
3480	cmd.exe
4324	cmd.exe
4264	cmd.exe
4664	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FwAwocws.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FwAwocws.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
2560	reg.exe
5856	reg.exe
2216	reg.exe
1976	reg.exe
4488	reg.exe
2772	reg.exe
204	reg.exe
4368	reg.exe
4468	reg.exe
4620	reg.exe
5660	reg.exe
2468	reg.exe
6024	reg.exe
2688	reg.exe
3172	reg.exe
2496	reg.exe
2100	reg.exe
3032	reg.exe
4688	reg.exe
5212	reg.exe
4864	reg.exe
6044	reg.exe
1856	reg.exe
5704	reg.exe
1272	reg.exe
3744	reg.exe
1908	reg.exe
4356	reg.exe
3588	reg.exe
2672	reg.exe
1908	reg.exe
2776	reg.exe
3196	reg.exe
4368	reg.exe
4464	reg.exe
240	reg.exe
4520	reg.exe
5428	reg.exe
256	reg.exe
1660	reg.exe
3068	reg.exe
1876	reg.exe
6108	reg.exe
6068	reg.exe
2800	reg.exe
2340	reg.exe
5916	reg.exe
1660	reg.exe
4932	reg.exe
3032	reg.exe
3292	reg.exe
4920	reg.exe
3312	reg.exe
5992	reg.exe
5852	reg.exe
4968	reg.exe
3884	reg.exe
1732	reg.exe
4940	reg.exe
1724	reg.exe
5456	reg.exe
3196	reg.exe
4184	reg.exe
4988	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4768	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
4768	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
4768	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
4768	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
2936	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
2936	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
2936	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
2936	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
4304	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
4304	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
4304	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
4304	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
1812	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
1812	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
1812	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
1812	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
6140	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
6140	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
6140	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
6140	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
688	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
688	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
688	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
688	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
4956	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
4956	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
4956	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
4956	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
2696	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
2696	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
2696	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
2696	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
5832	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
5832	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
5832	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
5832	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
1592	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
1592	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
1592	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
1592	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
2732	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
2732	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
2732	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
2732	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
5680	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
5680	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
5680	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
5680	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
4248	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
4248	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
4248	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
4248	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
2656	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
2656	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
2656	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
2656	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
2116	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
2116	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
2116	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
2116	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
2436	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
2436	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
2436	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
2436	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
472	FwAwocws.exe
472	FwAwocws.exe
472	FwAwocws.exe
472	FwAwocws.exe
472	FwAwocws.exe
472	FwAwocws.exe
472	FwAwocws.exe
472	FwAwocws.exe
472	FwAwocws.exe
472	FwAwocws.exe
472	FwAwocws.exe
472	FwAwocws.exe
472	FwAwocws.exe
472	FwAwocws.exe
472	FwAwocws.exe
472	FwAwocws.exe
472	FwAwocws.exe
472	FwAwocws.exe
472	FwAwocws.exe
472	FwAwocws.exe
472	FwAwocws.exe
472	FwAwocws.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 5656	4768	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	89
PID 4768 wrote to memory of 5272	4768	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	90
PID 4768 wrote to memory of 1896	4768	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	93
PID 4768 wrote to memory of 240	4768	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	96
PID 4768 wrote to memory of 256	4768	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	97
PID 4768 wrote to memory of 204	4768	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	98
PID 4768 wrote to memory of 4772	4768	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	99
PID 1896 wrote to memory of 2936	1896	cmd.exe	104
PID 2936 wrote to memory of 2796	2936	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	106
PID 2936 wrote to memory of 5004	2936	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	109
PID 2936 wrote to memory of 4688	2936	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	110
PID 2936 wrote to memory of 2468	2936	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	111
PID 2936 wrote to memory of 3524	2936	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	112
PID 2796 wrote to memory of 4304	2796	cmd.exe	117
PID 3524 wrote to memory of 4496	3524	cmd.exe	331
PID 4772 wrote to memory of 3856	4772	cmd.exe	119
PID 4304 wrote to memory of 2344	4304	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	120
PID 2344 wrote to memory of 1812	2344	cmd.exe	122
PID 4304 wrote to memory of 1732	4304	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	123
PID 4304 wrote to memory of 3588	4304	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	124
PID 4304 wrote to memory of 5992	4304	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	125
PID 4304 wrote to memory of 6060	4304	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	126
PID 1812 wrote to memory of 792	1812	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	131
PID 6060 wrote to memory of 3896	6060	cmd.exe	133
PID 792 wrote to memory of 6140	792	cmd.exe	134
PID 1812 wrote to memory of 4184	1812	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	277
PID 1812 wrote to memory of 4920	1812	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	282
PID 1812 wrote to memory of 4368	1812	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	279
PID 1812 wrote to memory of 3480	1812	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	138
PID 3480 wrote to memory of 2492	3480	cmd.exe	143
PID 6140 wrote to memory of 2700	6140	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	144
PID 2700 wrote to memory of 688	2700	cmd.exe	146
PID 6140 wrote to memory of 4940	6140	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	147
PID 6140 wrote to memory of 1724	6140	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	148
PID 6140 wrote to memory of 2672	6140	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	149
PID 6140 wrote to memory of 5636	6140	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	150
PID 688 wrote to memory of 5936	688	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	155
PID 688 wrote to memory of 1660	688	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	305
PID 688 wrote to memory of 1856	688	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	158
PID 688 wrote to memory of 5212	688	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	159
PID 5636 wrote to memory of 4164	5636	cmd.exe	160
PID 688 wrote to memory of 4188	688	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	161
PID 5936 wrote to memory of 4956	5936	cmd.exe	166
PID 4188 wrote to memory of 3212	4188	cmd.exe	314
PID 4956 wrote to memory of 5820	4956	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	168
PID 4956 wrote to memory of 4968	4956	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	250
PID 4956 wrote to memory of 4468	4956	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	171
PID 4956 wrote to memory of 4520	4956	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	172
PID 4956 wrote to memory of 3028	4956	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	173
PID 5820 wrote to memory of 2696	5820	cmd.exe	175
PID 3028 wrote to memory of 4488	3028	cmd.exe	340
PID 2696 wrote to memory of 1516	2696	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	180
PID 1516 wrote to memory of 5832	1516	cmd.exe	182
PID 2696 wrote to memory of 3884	2696	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	183
PID 2696 wrote to memory of 4988	2696	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	184
PID 2696 wrote to memory of 5704	2696	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	185
PID 2696 wrote to memory of 2500	2696	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	186
PID 2500 wrote to memory of 5052	2500	cmd.exe	191
PID 5832 wrote to memory of 5684	5832	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	192
PID 5832 wrote to memory of 1908	5832	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	343
PID 5684 wrote to memory of 1592	5684	cmd.exe	195
PID 5832 wrote to memory of 1272	5832	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	274
PID 5832 wrote to memory of 3068	5832	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	197
PID 5832 wrote to memory of 6136	5832	2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe	198

C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\LEkEYcYc\FwAwocws.exe
  "C:\Users\Admin\LEkEYcYc\FwAwocws.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5656
- C:\ProgramData\OggcIssY\PcIEMwQA.exe
  "C:\ProgramData\OggcIssY\PcIEMwQA.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:5272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2936
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4304
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock"
        8⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:6140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock"
        10⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock
        11⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock"
        12⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock
        13⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock"
        14⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock
        15⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock"
        16⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock
        17⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock"
        18⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock
        19⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock"
        20⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock
        21⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock"
        22⤵
        Executes a command shell one-liner
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock
        23⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock"
        24⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock
        25⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock"
        26⤵
        Executes a command shell one-liner
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock
        27⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock"
        28⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock
        29⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock"
        30⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock
        31⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock"
        32⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4264
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        33⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock
        33⤵
        System Location Discovery: System Language Discovery
        
        PID:4852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock"
        34⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock
        35⤵
        System Location Discovery: System Language Discovery
        
        PID:5816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock"
        36⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock
        37⤵
        System Location Discovery: System Language Discovery
        
        PID:4944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock"
        38⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock
        39⤵
        System Location Discovery: System Language Discovery
        
        PID:3212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock"
        40⤵
        Executes a command shell one-liner
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock
        41⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock"
        42⤵
        Executes a command shell one-liner
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock
        43⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock"
        44⤵
        Executes a command shell one-liner
        
        PID:1616
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        44⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4464
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        44⤵
        Modifies registry key
        
        PID:2340
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        44⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JOoEMckM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe""
        44⤵
        Executes a command shell one-liner
        
        PID:4976
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        45⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:5860
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        42⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:6068
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        42⤵
        Modifies registry key
        
        PID:2800
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        43⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        42⤵
        UAC bypass
        Modifies registry key
        
        PID:4488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NOYcAogk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe""
        42⤵
        Executes a command shell one-liner
        
        PID:1556
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        43⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        43⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:3240
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        40⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:2216
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        40⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:6044
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        41⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        40⤵
        UAC bypass
        Modifies registry key
        
        PID:1976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ikUAogcI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe""
        40⤵
        Executes a command shell one-liner
        
        PID:5700
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        41⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4648
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        38⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4932
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        38⤵
        Modifies registry key
        
        PID:2772
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        38⤵
        UAC bypass
        Modifies registry key
        
        PID:3292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\woAMggAQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe""
        38⤵
        Executes a command shell one-liner
        
        PID:4756
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        39⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:2040
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        36⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3312
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        36⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5660
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        36⤵
        UAC bypass
        Modifies registry key
        
        PID:1660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aqAkYIss.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe""
        36⤵
        Executes a command shell one-liner
        
        PID:2812
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        37⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4576
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        34⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:6108
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        34⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3196
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        34⤵
        UAC bypass
        Modifies registry key
        
        PID:3032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ekoMUgMk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe""
        34⤵
        Executes a command shell one-liner
        
        PID:4960
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        35⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:5068
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        32⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4368
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        32⤵
        Modifies registry key
        
        PID:1876
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        32⤵
        UAC bypass
        Modifies registry key
        
        PID:2100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TkgsEwEE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe""
        32⤵
        Executes a command shell one-liner
        
        PID:4920
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        33⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5092
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        30⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:2776
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        30⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5856
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        30⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HQUQMUMA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe""
        30⤵
        Executes a command shell one-liner
        
        PID:2084
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        31⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        31⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4980
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        28⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:3172
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        28⤵
        Modifies registry key
        
        PID:5852
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        28⤵
        UAC bypass
        Modifies registry key
        
        PID:2496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kqMsEIck.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe""
        28⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2804
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        29⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:6068
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        26⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:5428
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        26⤵
        Modifies registry key
        
        PID:2560
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        26⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wkwAQgAQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe""
        26⤵
        Executes a command shell one-liner
        
        PID:3508
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        27⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        27⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5700
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        24⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:3744
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        24⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        24⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YMYUsMEo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe""
        24⤵
        Executes a command shell one-liner
        
        PID:5560
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        25⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3440
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        22⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:3196
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        22⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3032
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        22⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bMkcYEUs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe""
        22⤵
        Executes a command shell one-liner
        
        PID:6004
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        23⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:2836
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        20⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:6024
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        20⤵
        Modifies registry key
        
        PID:2688
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        20⤵
        UAC bypass
        Modifies registry key
        
        PID:5916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PiYgQMwQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe""
        20⤵
        Executes a command shell one-liner
        
        PID:3300
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        21⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:4060
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        18⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1908
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        18⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1272
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        18⤵
        UAC bypass
        Modifies registry key
        
        PID:3068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rOogIEUo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe""
        18⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:6136
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        19⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5940
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        16⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:3884
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        16⤵
        Modifies registry key
        
        PID:4988
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        16⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ICcAQkgU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe""
        16⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        17⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:5052
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        14⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4968
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        14⤵
        Modifies registry key
        
        PID:4468
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        14⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IMkkMIQI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe""
        14⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3028
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        15⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:4488
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        12⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1660
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        12⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1856
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        12⤵
        UAC bypass
        Modifies registry key
        
        PID:5212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EGgoAkME.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe""
        12⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4188
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        13⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3212
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        10⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4940
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        10⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1724
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        10⤵
        UAC bypass
        Modifies registry key
        
        PID:2672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dUYUkIAM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe""
        10⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5636
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        11⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4164
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        8⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4184
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        8⤵
        Modifies registry key
        
        PID:4920
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        8⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vqQsIsMY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe""
        8⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3480
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        9⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:2492
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        6⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1732
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        6⤵
        Modifies registry key
        
        PID:3588
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        6⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5992
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PqkcIgwE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:6060
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3896
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:5004
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4688
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2468
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ASIokAwE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe""
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3524
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4496
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies registry key
  PID:240
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:256
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - UAC bypass
  - Modifies registry key
  PID:204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QWkQUooM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock.exe""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:3856

C:\ProgramData\ZcUUcIoY\gGYscEgU.exe
C:\ProgramData\ZcUUcIoY\gGYscEgU.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:4128

C:\Users\Admin\LEkEYcYc\FwAwocws.exe
C:\Users\Admin\LEkEYcYc\FwAwocws.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:472

C:\ProgramData\OggcIssY\PcIEMwQA.exe
C:\ProgramData\OggcIssY\PcIEMwQA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OYEY.txt

Path C:\ProgramData\OYEY.txt
Size 7KB
SHA256 6b6a8091e65f0dbbdbed5610f405fdf074270b0c9290cf8f1994b73768780779
MD5 07eedcf14ee004bfb012b9975b2ac8f5
SHA1 3b28df3f3d1d2fe363f884ed2cf0c1d29cca4f7c
SHA512 cd4045d660285ce8a5dd73e6b8c55fe3334b80d223aa71ad547868b6b9dcbeab59f03ef23c707d6e379e23f63677f8a566f3e91880c1fb505658d97448aa3f6b
SSDEEP 48:U563KS01Cys3KSwM3KSqk3KSjM83vE1Cys3vzMQ:XKS01MKSjKSpKSjfvE1MvN
TLSH
T14DE180312AE8163FFBB751B1C3F148B1A927F8526610CC8EA076424A4837E825DD0F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PcIEMwQA.exe

Path C:\ProgramData\OggcIssY\PcIEMwQA.exe
Size 1.6MB
SHA256 03523f8bbfa1a99c3b8a687e66c0c72e75e9c80b4f3273c04281ac49fdcb5b36
MD5 2360b187843dd56aa2e54afb0d509f63
SHA1 40d27e541e055fd796acb001e5af17b96a2648f1
SHA512 e925def5de06fc9eaf4108fbe11f54391d778d05e5c98149d1d6a7a0b0e9e388f6339fddb7f2c170ca3a560c8c8d311378c4e654f2efc1aea371cad4b3feb79b
SSDEEP 24576:9FfBX2AUgnj5mGiY/PEZG8V+v3aGXCTCG3PS:9FfcAUg1jiY/8Y8Ve/STC+PS
TLSH
T118756673497AD39F081F14438AD76AB996E8FC1782ABC5ED7D60C2A6D41ACB460C4FD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gGYscEgU.exe

Path C:\ProgramData\ZcUUcIoY\gGYscEgU.exe
Size 1.6MB
SHA256 00228296b8f4695728ec13756318264efd2186e05ca68a868d00116b0d75b028
MD5 457b5fbd97c703e4ee613ce269b57724
SHA1 690177699276fb9582c63d5efe3c5d15e9fa658d
SHA512 26bf4b76db25c3f01524d99615ce4e6adce2188074ad8d74be85204ddeb71b10407aa9acce6b1481f45574e4d6444f3b488c7ddbebe162675226f491431c8fe4
SSDEEP 24576:072At685EgZV20lVEC7mNlGRDRbu4Why:RAt685EgZVxXG89Nas
TLSH
T10875CA670065C922C4EFA6D7164D9308E285C29FA80BE1CC178C9B9BFFB55FE152C94B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock

Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_519410c8a6539ac48928f374cf619be8_elex_virlock
Size 43KB
SHA256 609824cc9c4f6c26c529ea3eb6f112c1a7c74d5ed58e25b6f9d88dce5944626a
MD5 7051c15362866f6411ff4906403f2c54
SHA1 768b062b336675ff9a2b9fcff0ce1057234a5399
SHA512 5fcbb98b9f421ee9884b8e927774de3d60043401b2f746f7af6aa059fa8a7c48f00ec3c2437f8e6687e0c328d0d2c79427d5ab5eed0805aa9e2a8b12a6418f08
SSDEEP 768:535IyJCYFakAnKI1Uu0IIjMwFtNy2Sp9oRnMcHCe+X28hGlrBw/21Qo:7C0AKImaIjM+A2K9mnMcHX+G8h2
TLSH
T18313E1C44541B3EE3577415134D8B0CA37788A7764582B19A4C42AEA7D8BCA3E7AB34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ASIokAwE.bat

Path C:\Users\Admin\AppData\Local\Temp\ASIokAwE.bat
Size 112B
SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
MD5 bae1095f340720d965898063fede1273
SHA1 455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA512 4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
TLSH
T12DB0924C2C8880FC0D108E82881CC42AF1CCC0C1C394401AA0A30688E33CEA89ED6AC6
MD5 SHA1 SHA512 TLSH

Submit Download

file.vbs

Path C:\Users\Admin\AppData\Local\Temp\file.vbs
Size 19B
SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
MD5 4afb5c4527091738faf9cd4addf9d34e
SHA1 170ba9d866894c1b109b62649b1893eb90350459
SHA512 16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
MD5 SHA1 SHA512

Submit Download

FwAwocws.exe

Path C:\Users\Admin\LEkEYcYc\FwAwocws.exe
Size 1.6MB
SHA256 eb6c5334320d538a9bcfbe379701ca3c3668be70e5d6ef72f7d069608a784000
MD5 c44a2d5075cc997327e78fcdf89c0f5f
SHA1 b72e3ead43e874c30b5bc02604db94a6dc0de903
SHA512 8cc863c42fcfac3d61e0098dbb896ce18d302773a144fe9ed65278d554fb08818b2106236d30bc4405ff3636964ffdd456c9e63f7bd38ade2bb72c4eba04443e
SSDEEP 24576:W9CyyhCMvSA3NoUnOba7QwNfgs49h/X215vUx:JQ2/fT2qU
TLSH
T17075DEEAEC94318E1536D72588400AE6347E45334D1AE3B290991E0AE537ABF36DF4F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FwAwocws.inf

Path C:\Users\Admin\LEkEYcYc\FwAwocws.inf
Size 4B
SHA256 0fb55f27452ecddf29010cddbb0e781e5ff897f59b3c893894568c2c3ed031cd
MD5 153bb029e6317107a01b951e707ee12d
SHA1 d27d72c0ab7d858014769b35151cc6157553bd0e
SHA512 0ddd49690df813fee9df56e086b5eb555bb00dd82a331cae945457c98bd08d6fe53b3a67c287c012a7b6f5b0bc9ee3c06f9d8096aadaf6c53e062b75d21d4de9
MD5 SHA1 SHA512

Submit Download

FwAwocws.inf

Path C:\Users\Admin\LEkEYcYc\FwAwocws.inf
Size 4B
SHA256 76752f6788844d78445e8c68cb31e200e1b365b65e4aeb7208901759674fc791
MD5 704058a7b0fc4522e502fc5d1d4a279e
SHA1 0ebf293df7af4d6d827d601eb4291ef0cbb8442c
SHA512 de5ddeb179194ff1e36717b21f16b224088e409a12c0161180ad81dc9c76311b8944732cbb35d506159b0acc1b422f627fea0bcbe0a7cf19257bc43e3f15c2d1
MD5 SHA1 SHA512

Submit Download

FwAwocws.inf

Path C:\Users\Admin\LEkEYcYc\FwAwocws.inf
Size 4B
SHA256 b768ee16174067491100d9fd025b492e88d9668331cb5a5f640482bb51766278
MD5 a1bc7f8fadcc68ac72c9ab0754205191
SHA1 2dfd46f079406b743a3cc57eb14dfd5205ba83c0
SHA512 b3b9f5e0b6910617b48b194cba2fa050bcdf9fff7fd81cbabfb7f4afb6f5180f8c65e2187d2ea6e2339fc588c15d962c6a4501edb9fca14e80bd9857a0fe3af6
MD5 SHA1 SHA512

Submit Download

FwAwocws.inf

Path C:\Users\Admin\LEkEYcYc\FwAwocws.inf
Size 4B
SHA256 6de67d8a571c906888bb1183d96f00d6834b0deb24f283e404f9e771039895ad
MD5 bcf7dff1c784eadda7b76b7d7235ed39
SHA1 6a3eb6f329b0a0f83e3fc9ed65e50087cbd67e44
SHA512 a0a3e30245d017b9b770f7aed4720bedf81a8e4eb56bb78c7cbf0f25d3c13f8c72f6ca1f51f6e629c372b50d5daf9ebc9818f1a78801adaaa06e001163dfb42c
MD5 SHA1 SHA512

Submit Download

FwAwocws.inf

Path C:\Users\Admin\LEkEYcYc\FwAwocws.inf
Size 4B
SHA256 f659c97d74bc1dc89c340528f1999cbd1f24f897be7e46d11f496132e160a776
MD5 4f2b636fca54eb11cef1942fc848d834
SHA1 1e742074a24b15ce2391658584b5a42033a2acd8
SHA512 1668d047ad83e0a6bdd10c8ee97137b2b994765115a8609f44b03360b5145f8b99f224a1c762133b0d44fb69f35ea9b9f07515802b47a0371bae69b4da5e1c12
MD5 SHA1 SHA512

Submit Download

AAQm.exe

Path C:\Windows\AAQm.exe
Size 1.6MB
SHA256 9a4216a65342eb9c8112ea23c8a3249d94072ae3d156065763e7518a53f705d9
MD5 4ce98dfa6014a1d8a06203d7cdd532ad
SHA1 989fc187bbeda815f346cb817f51f6fed46b885d
SHA512 d337ffb1f0d99854078fc424ef3671bcf7f22d8b35b5c8081647dd65c8cd759a20037886856ce646c0f9d77e898a445ce1d0a1551c7ac4d41f606b20ba067f59
SSDEEP 24576:oB5crY8IvA6E1MsrcyrFmGNubRZQ6b+qS6+QeU4xr73oe2Nx7VrZld4mvcFbcsDm:oBy/IvAPVrBtp0rEQo
TLSH
T1817585844D75113349E109B88BD52C2FC671CAA782BB7E6E7A600AB473CE4C2D7735E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AEAc.exe

Path C:\Windows\AEAc.exe
Size 3.1MB
SHA256 243cc24e48fe21f9e18a3ed5f9d9fda4d2373c2f33ceeae4e1f18c7e248cb49f
MD5 34b6cc1064e4ce6e526f8de1f7af1c10
SHA1 931e4e7c4a62dcc49f1396a44e9eb891d4552675
SHA512 88d9d430817510110a4e6bc105c7c898d90ab9d61a9a1a37a8e3d51a552059faa3ef5d89c9ddaf0c7dd08bc24781b802f6c98873b4fe52ab6b7f4ba1e49a8946
SSDEEP 49152:bv3XZHIFTrgXmgbFHTWGDcmeFOQHJLJnYLAdvoZvviB:bxHIUFzBDl6F4Lvm
TLSH
T1F8E5F8AF63E3B1BBA139AC2469608D958D8D4BCD751B440002FA65492C725C6FB3FF1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AIwg.exe

Path C:\Windows\AIwg.exe
Size 1.6MB
SHA256 ff58283c3803839a8baa3a203cbd944bf05626bb4224dfabf4b4b2ae969c1ccc
MD5 b9b5a38018e7558c693895f764184d75
SHA1 4d1709209623ad476a568bc4140e0a3ef1e166a9
SHA512 d1d3b0679876fc279da8ae734b3ec2d5645be5bcfedf088b8b21b9d1d3549ab291e632e256084a8fc48b6ddab301237738766f098a04dec12478f043dbe1971a
SSDEEP 49152:bENxVmnZNH1BWOO2Hc4TzRx1oodSNQJmRWEP3:bENxVmnZNHvFx1oogNymQEP3
TLSH
T1A975DEFE6F144C19BA8D501CDCCBBC893764A5B0FB553CA910A1BD3A3794AD8C9E8C91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AUgA.exe

Path C:\Windows\AUgA.exe
Size 1.6MB
SHA256 aac7aa0cff952ac20e6daecf4333460f6cc0885902f467abbc2b68b0b37d603c
MD5 d6ca219bad7b88a55e64a3f9306f5164
SHA1 efa1d14441e7c01b5e622f56c03685068ecd0f85
SHA512 afcd541811f3da8383b6f17272011380eef2dfd9615f42c0b135a70d90185545b184c2f3af42808635bb161ba27de8c23ce54157b4c3a44e843e7ea983690dc3
SSDEEP 12288:Y+wftIHMDufMQbBZE+USZxmYfjFVXcdhKQwTIUZ9Y0MXJC/FygDhmAA3HIF:z8tG3xmg7XCKQ2oJJWFdru
TLSH
T16775799400C925C52B7B2609B39A9480EC41EC44ACAE7D7DFC8C72C499B1D7BF7D39A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AYIM.exe

Path C:\Windows\AYIM.exe
Size 1.8MB
SHA256 ee0890002aa38792932e7d34ac4c9330c2a83088bb6659e1b667eedb76caf958
MD5 f77f9b3aca21f07308208d8bc0ecf3d0
SHA1 0a1721e985d01690e2cd156d174d6982f8d36717
SHA512 1ce1b9b964ffc18fa099c6d1b8d4d5a1bd4b4bcabaddb37e66b44e8b3cbd438c1b1e3cab1b6972dbc623ca853c8b77ab9cd55ccbe95fbecde2ab2238de124a26
SSDEEP 24576:n0wgn5+Io8ThxwANRFEKVN+reG8HntPfPmAijF:dg8yhxw7aN+iG8NPG7
TLSH
T16A95CBEA37DB83B51DAC572442744A6468BE955CC3A08EE21FFFB399D4E34F462E4402
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AYUq.exe

Path C:\Windows\AYUq.exe
Size 1.7MB
SHA256 7e360cfce40c8a417cb0bc173475f8f007795002eaf961a0cbf4fa18d6f9a242
MD5 c2e0de14657f49682a558ef344b75961
SHA1 201b3ac7ea2e7f5ed128a9e103bbc4498c4bed3a
SHA512 9169898fb358ed8414434d70d61d4905638ca747cdb395837e14999df0618c7acc8b3d6c745df6df282c86a8be6447d128fac9951bc12b0688ce251b73507dc2
SSDEEP 24576:mNRwHSChvGV6OvxuGadxmZj5aYviNKAQfrWMzYoy:G4K6Ovoi5aYqMAQHB
TLSH
T13285FEF651B38B26E7C2C587ACCE186C9C0C09F418973AFEA45EC20B559ED6C8D635D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AwkO.exe

Path C:\Windows\AwkO.exe
Size 1.6MB
SHA256 c19d11480747a4a851c1244f538fc5f2f62546e60936776b9f023ec07c6ed24f
MD5 a808ed18195f07ab4e439fb3c788f39d
SHA1 74cfd2c1da538b9977daebb0c38b7aef87a5344e
SHA512 af48cc5c52c4d86a96b30af79050b37445e7e7bd9b8240ecd64bd6bf47a27fc66de5f3a702e709692fa746bebf64da29a3c86dfcd3c40bd11832d2eef560a408
SSDEEP 12288:pnX8Py60vdcQEOYb8YcXFkDXF45GyFnl1IzdF6pgjPF+vugT69Tu8dhj7B:pcQwSXyX25rFnG6CjougSTu8bZ
TLSH
T15675FB07F1C8C0DBEEC608BFD9AD19542444B4B6AA3B6DB3120B6F4D2942FD6B12561F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUIE.exe

Path C:\Windows\CUIE.exe
Size 1.7MB
SHA256 a7e2c77e9752098127c7cecb0f6f3cceed8c8aafb492c77e4389c63502149913
MD5 2419caca0bc6950059a094c59e25e333
SHA1 1391c104c9d4a66bfa671adb4f734940447205ac
SHA512 139fe90270db8f42589919575888f6c74505f4c396fcc597d47070918eeed914b05c80d4e558165e2698d01b82a2af3d33c5e88d0ed74a09ea9743b48397a95b
SSDEEP 24576:PemCptKKfDo6ulMzKxERSP6F9PaWAssbwss0d32:PemYjo5MmyYP6PWssUss0d3
TLSH
T128850CB92FA95CDC5AA4C3098619633BA71F8835CFD07A83D45F2B5624C825317F31BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CkEG.exe

Path C:\Windows\CkEG.exe
Size 2.1MB
SHA256 315846a04eb73c2249387573a8abf6ae176f46372551d458cb32d9b6c7488a11
MD5 4bb17e8ebbfe6a304a1598862598c674
SHA1 4ee6eb9d0ab21008fa2fb8638e82dc9ef07ec029
SHA512 62adb963496de736c99336859116884fd1e4ec5a15f1c442f901cadae00dcd324f156e80f78257ae57217bd82201bd7eb273227a0c5c4ed02e6d39d0b31db22a
SSDEEP 24576:3vKQ7P0esuecNZuN8qpFUKk4mhkZVDbtIc6iboU0xHhYdH:3vK0Bsuec7vKpHtIcfaHYd
TLSH
T16AA571892D48E31C41D033FEE0F1E2A79A1D21E5B49BDE3B692DC5F542E9CF02AB1654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EIgW.exe

Path C:\Windows\EIgW.exe
Size 1.6MB
SHA256 241ef0f35bf8f3ca78372c90dd6de25ba82c1dffcdbe77b5ec9cc534999bd1cc
MD5 d8bc0ada6a0dc70e03ddb80cda905887
SHA1 875ddaf14e92266a45fe64610eba8e2f44c9f07b
SHA512 fd511172a8ef10c430f9bbb39d96d7d8afd96017e9b0bdcf4dc86b20079c67c254f7f263b48c6ebf6fca0e1fa8ad1a7e3a15c1522516a95dbf149567c2ab6d19
SSDEEP 24576:KKWtX/feW7gQBNu0B+GVjcFRm9BKQ217r:KNX/fe1MNuijamPk1
TLSH
T16A758B5918D4C0FED6ECC86BCD2FF073BD72D416DD011B9A090C8D6B8D3A692D90AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EYQU.exe

Path C:\Windows\EYQU.exe
Size 1.6MB
SHA256 4471d70dd64286646a20a595b5d07e42ac18ebec1c05f0ad41d965bb003439d4
MD5 91487d77ccbff7eab39e19d59d66bfd2
SHA1 0f923142c226b46704bafacd1004f7ba51a308fe
SHA512 718d2940f0ca227b8fd5a95ca00854becdff5594efeb388ab565ca5e3dd94db8bc55caf4fd3dc91711b3bf045d4d6f51fd0f481769425d2f207c7c33070ed9e0
SSDEEP 12288:g8G2P08B3DnHRLFWxIDiw2pf6J4sSUDP77lUQ2Gbe8u7p14:gOTYO91UH8A14
TLSH
T19F75CC6D788437DBBB011B7738958902853215C66CEB64908DBF8A43DBB1A37EDDE42C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EYsS.exe

Path C:\Windows\EYsS.exe
Size 3.0MB
SHA256 230c10ede8ba1b40850222dfb36670f4b876e2778d09f633be1a88f291c38d22
MD5 a60eaf44c31d6dcf7506ab5079a715b1
SHA1 8b6f8bb5b5236eb1306fe57e8ab83be979d587ae
SHA512 81525b1dcf923715c304f3856fdd7a1544836536211c75f325d9724f57eba9adf901b68fc0f7117ade1a58d524ba46fe3b4996b24e9ffeb51632c01faa99d5cc
SSDEEP 49152:EKBSysSJnYWi5wTB4Hc4yXnGRRR7TggOm8WkEWuBGeh7:7LJYOt4pqnaR1UgOm7XW8Lt
TLSH
T194E59002161BFC27B5C379DEFE0A5CFFE4014609E5410392E28EA1DFE499716ADBB642
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EkIe.exe

Path C:\Windows\EkIe.exe
Size 1.6MB
SHA256 1dfd9486921201de3307cbd1eabbb80366677182a22acd7236e10cc1ed04f990
MD5 0e2719a99a15a29c2a713a00fa269be6
SHA1 2eb4d7fb9ad8cc4695a06b3cb9b5f23774cff4a5
SHA512 1e96540b9ae9007ad450e5fa059e69dfccef2a818fbc06250e983dfa980fb77c34fbf97fe8fc76aa4e908acb1ae4a8dbf08df93515c1ba5282784156f69d4bf0
SSDEEP 12288:BimvUJjR/EKssba0wMr67tqfc2uH8wrQSI59kJozwtSA6WxIbqPkLLWx32590h87:U2C/Vssern7tqkFOSI5LqcLLG259o8
TLSH
T18775D73C60D0894A873F63CE2C99778CE88D49C63802C6D3F5A3191D975AB417F9BB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EkoY.exe

Path C:\Windows\EkoY.exe
Size 1.6MB
SHA256 b061bbde9ecaddd1d4f2451f7baea696a68a3a59bd958e7b24c606b0151fe670
MD5 3b0d424fc39244eab8e14fba487a810f
SHA1 b0829437bd76e13bd1797befeab6d7950ea0a22c
SHA512 51eea7af3be7009e747e32a0872d4ad894978ad71b50c2745b6b3ffe03384b6f15b64532d72b41ef59bd6486df93b0e07d86f2e89a3c9dc7752685c5e4c7bfe5
SSDEEP 24576:8H3tZ7fK7TZ7HQfkXDoVayrmu/2dreGAPfEX:8dZ7fK7TZ7HQfkXDoVayrmu/Lb
TLSH
T199752C3F98BABB5BF77AA9AC1F0BF1C6D35E0969032B6811740E50543F5D0F06829C66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EowA.exe

Path C:\Windows\EowA.exe
Size 1.6MB
SHA256 cc88a8bcd07643421104fdf469a907dc647e02ea2eeeaf5023f767a7c7d646cd
MD5 2e71837c6fad7611fb88b94f2245c0c2
SHA1 5e28db9feefa1427087bb09ba4c61f1c1e9d8f8d
SHA512 921e5842c1b5d55e0138e61a8d9c1f0dfdb66d169cacb53a774dbd7f290b358fbb6e6e8f84aeade353bca5139dc00d4f7fcffac15467850c4dcb510df28599fd
SSDEEP 12288:Isa9J1h17SIfTFOQ75dYEAPhudf6x1Ppa4ZFcZ+LUk7:sJHxS+FpchUf6xO
TLSH
T16375DDD98400891F7963F21A7341A1C88D5E3AA391D57D1B1303335D6ECE2A9EF7E68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EqcA.ico

Path C:\Windows\EqcA.ico
Size 4KB
SHA256 5963420fd9ba8c8248e3f50d179dfa21caca8538ad1482a03f260b27cf218043
MD5 11f567ee7cd81363d091bd0a1e6e57b0
SHA1 506bacdc816e7638ad6cf2c83e40a3924a72d8c4
SHA512 beebe8b70fc370737b5f4abba21a2301fd5341c3295e483f51eb03d5207090f662d2e19d3fa2b534ec51745d3eb399ccf0f1969aa3ae80b0543849133a8a9dc5
SSDEEP 96:hB3cOiEOiOvss4EVCd3jtjmjFj+RIvqqqqXyy/X:8CdkvX
TLSH
T13A91BBA223090D3AF9DDCFF06C9BB65595493A404EED29DC2CACF06A217EBF609F1000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GIoI.ico

Path C:\Windows\GIoI.ico
Size 4KB
SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
MD5 743bdd687434129391fd0c5c75f33ef3
SHA1 ab0696c2d38531ae88707df5c6f5e21cb8591a1c
SHA512 8b1a87f915c6ced6071cdf4a533ebd5caa93197687946dfaf8fa0d28c358f38b1b1e232329ff7ff73950d7d808290214cc1b7114ba97374a92fc5fd0ebbe585d
SSDEEP 96:tzwwwwwATlRCDCkiZi8C6CbqHTTejtjmjFj+RIW:hTlRCDCkiZi8C6CbqHTTE
TLSH
T176911A3723595C35FE514DF0BC9A9A9CE088BE5483C22D9427EDF99EB47D8C209FA850
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ggcw.exe

Path C:\Windows\Ggcw.exe
Size 2.4MB
SHA256 31fe62efd17974f17fc719341ee62dc987efc24d8eababb43be81ed0fa15a16a
MD5 41ded7d6317171517fb3a9adda5b2b5a
SHA1 99a379a3fae7079dfeea6afb970b324f3fbdd0a1
SHA512 404be494b152e040a396c0ef1db456113cf621253bf8f439382362d4fbdd7e8ec9a800a4469a7fad201c4de4f56ce4dc706a5c1697f9713485ee867bb34f1012
SSDEEP 49152:LXA56Vbb9Ru11jOd0jwUBFeHzH4/tJIB:LXA56VbbC11jrjwUB4H0i
TLSH
T132C540F62F409E110E887B061D58951DBD7CA3605D687BB82DA58BCF28D3CB216A13DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gogq.exe

Path C:\Windows\Gogq.exe
Size 1.6MB
SHA256 715f787a5b63d8a96721e06bec3424b1e635e915a5da78487697819d48d7249e
MD5 3e8d54f000dc5316d6674fad633f865b
SHA1 dcf1a101d61b26b77096858c3b56566f29e9eb09
SHA512 64983041c6ca087d856c4f462c848114ac2cf8cd18d95d9651e480ee439c036e460217b837c445bcbd1a1f336d0fa830ed8636f0b50270ea63a76e11a617386d
SSDEEP 24576:9u2oT2K/rq2d4yFYhQwl0DVCel0m/C4yWDG0:9Fo9/rq6RFYhQE0DVZp/LZDB
TLSH
T1EC7574AE4D2C7F0AC875549F37B97B75D68326A527ABC423C1EE73D482772B810221E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Goko.exe

Path C:\Windows\Goko.exe
Size 2.3MB
SHA256 e5ef8b1015a6601358b608599910bd0293fd7e03c0eb2ccc973ee9c920fe7341
MD5 8f694cb23ed4ec6e523589d3b04c901e
SHA1 f71fb2c1644648d8a63026b17223074b5e6b43bf
SHA512 67eb34eaedeb5833b0171b743580db8b6a1b4eedc4115aa920961c84566a3bd7b9f8f1ebe336c806b44b3786c144eff5f99a7cc31653cf068a8dc23da38dc99a
SSDEEP 24576:KNOY+WUQrZk2XUSPOmIi4XOojotMJicybGUuaVP6Eza5NrCjBDcf1:wTbtxPOmIfBjuNc45uWSEmXrSY
TLSH
T1D7B5958EB4745404E3A1E82743B2CBA70E959334668B4F8597E5FB28FFB149775320AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEUa.exe

Path C:\Windows\IEUa.exe
Size 2.0MB
SHA256 d47f686c9b4a063d1f6962b140090ac6d0c62c50780029edda5edf1b12ce673e
MD5 304ad5422367e65b1a84affd2e0324c3
SHA1 6e11a3496beb87291cb7a94ef5d21755aa234357
SHA512 0bbe21d842007f005d938e1f7f67c098a80038bc1ecfb7c9d5796682c34e5f67f76370ac2a571ac6fc3335aa25948e3c06cd1208624ea27beb0473f933812db1
SSDEEP 24576:8Q3MxNV/it/zCDMEUcgKct9Xv9atFASNqPEceUl8:n3MxN+/nEcf9yFw
TLSH
T1DCA5EA075E1EE5C90E8618C46EEEC07A6FB06FA9C1C5A783FDAB15489E85307746B334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEkU.ico

Path C:\Windows\IEkU.ico
Size 4KB
SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
MD5 7de70c5f9fde94ce0179324aa5720a58
SHA1 b34c69a980c52938d5b4377376adf15fad17dce6
SHA512 0b5b089bb8ae1a97e4a882f7e35c7295cb81127f0915379676590a2af296012782192381e2bf3d010f0a1c693e2eaaa2f083fd8fdd7c3191a8537b4553676ef1
SSDEEP 96:dic8fY4M1c/wHtOMreoBKc/0+ktbWrrdT+AP:dilkc6OMreSdStbSCA
TLSH
T10A91842274B416E8FA7DD977E242E0AB0E723C578B41422B71D3F7A70C710D81B0692E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IIYU.ico

Path C:\Windows\IIYU.ico
Size 4KB
SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
MD5 03c62b34b94a861c4f99017a91bc749e
SHA1 2ca36583370792d9d56be7e5db98417188adf5a6
SHA512 4260811ca36c05c15db789932b24767db68b0dfa1a0590e8d4f69328e208c38693e978d892e0d229756a8ab9092265e19b0a0da132f0542f8460be54ba6371f3
SSDEEP 24:su7zwwwwwoRLM4IRS00000xwbU66INLbXxtRmcjtjmjFj+RIW:tzwwwwwGLZ+wA6nNnXlNjtjmjFj+RIW
TLSH
T1CC91282223494C36F8D4CFF0AC9ABA956188BA544FD52EDC2DADF01E117EBF649F5010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IQkY.exe

Path C:\Windows\IQkY.exe
Size 2.2MB
SHA256 c9c44cc8b952d25266029d99e6f8a83952b5e20c4a90c3afd526064d7bf76336
MD5 6e7738eb7946692387814690f8880533
SHA1 a0343009672224ac4600b09736cc7b3cb1733cc4
SHA512 7d519f9f10caa338342e06aef2508cd7b24a59b8796e21652d06032bfb6e8e32b18bb0cf969770050556d2287a8f60288662d67235da51c0edb5fe271c330ae4
SSDEEP 24576:5Zwg4qHJbGCCpoxuME1xsc1RgakWDKTz9rB+sziRoM1CMkkNasKwqH9bB5pg+jp:5ZwmJbby5j1xscHSr7NM1SkHvqHHjz
TLSH
T17CA56412C2B4719CB650CCE4312D698AC35525B3171FB6DBB633A86A08BC7A7F2D12D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Igwu.exe

Path C:\Windows\Igwu.exe
Size 1.6MB
SHA256 9d94c5e0061efcff43c3325054810e08e944c6288997f6b0f8b7ebee28cb3764
MD5 daf2e1245391c7a1e90b510ae62542b7
SHA1 8fdd9b5aece70988ac816d9e600c40804b85c614
SHA512 d601b61f385a0b7e91ee5487db784fe59d84a03bed2ca07f1061f73fbe2ece3ab9e81a06771372869164547ac8022cf839458790a624c6afa2fa27fecb8fd524
SSDEEP 24576:dLPW5pwdt/2Uz1VwwH+es1e21XKH6PVFu:d4DU5Vaec1XKqVs
TLSH
T1917596DBA60447BF60327BE3ADC496DDC04FA8A65E8FACD009C842E1B53E5D114749BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IoQO.exe

Path C:\Windows\IoQO.exe
Size 1.9MB
SHA256 3dd864c7211d8a1ec3945609f9e0a2fe51934718a43e7ee5d2548a31c93874c5
MD5 af291882d40ee363f704e4b58b329783
SHA1 9261b7752ba9c411ff822ef156480ea52af82d2c
SHA512 f43e7ae3002e0be796e186c56e224c6a535f08e23984efc4e18b63d073604611afb9508b03ac388e32e80182e49ab0748976bb3aebcf8283e5b4c7e9fdfc11b5
SSDEEP 24576:lATqsEp0IanrbiV6WqqTqrKzHx1sQOpr4pySbdXcNgeuuhHs72hj5FfGvwYQ2kX9:SX4Tq2Trsl4uuuhHs7gd24O2
TLSH
T13D95EA7BB54DC8DDD37A62023332514F47266ABF287F8B0665ABC6700999CC0D619EEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IsQu.exe

Path C:\Windows\IsQu.exe
Size 1.6MB
SHA256 423333c60ef3b88eb7db04f098c22ada86817974e53318d2ca021c77abe8d069
MD5 3a253ddb611b602f598a67a8148d8d3e
SHA1 d2beff8c2e28745f872776f03f35d8695889f675
SHA512 1b10eacdf83e87a432a02939755100a03cf0b6c774dbbe7a701b28ce626fe0d166de5127e4593af7748fc9fb06d23a0258ce3c122d905462b4f5831e5e1628f4
SSDEEP 12288:DFHJzk2Y8K5xkNRp4h/fBslOOwUuSD7d69macUDLgEE8x5PVco:B6v8K5xk/eh/Zqt7w8XUrtz
TLSH
T1CD759871E5C3EB4970EFB9BD3E3280862F1B812401B35B8DADCB35F75A054688652DDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KEEY.exe

Path C:\Windows\KEEY.exe
Size 2.1MB
SHA256 54f1b1be239b830432e2f9a8fccb7d7f0534b834170923572cfd6ac375485a72
MD5 5ccaa6be759eb5fc259ef3fa17549ef8
SHA1 1613be64ba7972dcce82b8387aa24009fe57b158
SHA512 7d63c241a5244c323ad319865476fb6319ec72f3e77986252f086d908c7e0f4ee24d33f2cc263c1345685de1dd519f2a7e2f2ceb650cae815a4b8164f478022c
SSDEEP 24576:rB1gJpIYdKaoGFxZP02Nqrq/suSO2lJzVZZiuY0I+GfukSgOnne:r8JpPjtFr02mq/zSFRZDYj+xsOne
TLSH
T18FA57162569C4F13882FED2842993D2D3810BF9597FF724343EED6EBEB809099558E1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KMIG.exe

Path C:\Windows\KMIG.exe
Size 2.0MB
SHA256 4032fbb46e6a0b1d9a045ccb2f72073e3d1b0aaa92ddf12df13f6a85a11f055d
MD5 dcfeb99535ceb77db5625b1639fb0d00
SHA1 5684c4f476ac8ca525fbc0107d9d2a1c143372b6
SHA512 a8b96464f3f9a2bcd1c47e915947624d82000907687d7b90a8a0e26fb41c588c495d239dfd741482384161742b8608e60f37df06e8310c2a431e57ecce451187
SSDEEP 24576:Gc1Mvz3camABU8SiLBh+/yI8ze0fQy66SPWEaGlm0Ef:GTv7BAM+/yW0fQl6SPNacm0Ef
TLSH
T117A5CA869BAC7566B029281BC4D33E1B5ACF79DCB7013E1FC2FDB300519295B9C8E952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KoMG.exe

Path C:\Windows\KoMG.exe
Size 1.8MB
SHA256 1463e39866ccb7ed749b109bcc15e2af363ed4444e66235e2d514872ba0815ee
MD5 28c4b57d2543bc145e92d0e74db10d55
SHA1 7ccaae4f04a896696c240dbdd725070a260fcecd
SHA512 43e6a3901976a62063ac410758e1f6d8ff43b2d9a84c72985698f6953b7d43da2107755942883e70283aeabbefba6c82236801fa6d48b43be15bf643423231dc
SSDEEP 24576:UGjSDtPEqHgb19BKVcNJfd4ES5n7AJLJYaqIj6Pd73Qge+eM+KPeJ8M72sdrxLWi:UKSDt859Bf3zWPQ2snGG4ZLX5
TLSH
T17C95FCD658285D3485F78934634316032561A4FA78F8CEBD8637139DABCBF863CA07A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KwcO.exe

Path C:\Windows\KwcO.exe
Size 1.6MB
SHA256 cec74d76d9cbbaf9bfd53dfb0ce9e077fe57715890a09b56eb3788ea6b0ff95e
MD5 67f59d3d8f467dacd8f664cd60d07d16
SHA1 124d5ab6281aca304f17ea4bb6728429d5033d60
SHA512 1032e74803bde13cda4149e6a28e56f8ae582c20631be8f6b4f56de25e0028e7219cf00d32fc098fa6fd51422cd402350f35496179a7a8401484c9bcc7396193
SSDEEP 24576:4ZDhBPewSoNhgFG3mhMyCsDBouJQ8MBye/6:47SihQYmhMyCo68MK
TLSH
T17B755B5D2E55CCEB47DAD226C0D743AD69D94B7FA0D083349F6CC67BA899A32420CCB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kwgq.exe

Path C:\Windows\Kwgq.exe
Size 1.8MB
SHA256 98f96950de0f16909b9ba8fa6e5819e5ae440c7c24591e223f8a2871fe41a5d2
MD5 4997a6d4bced14e2aa1a1cece4d0ef6a
SHA1 1159ec840b0450b0e9c574d0fea7d99e18f7e78e
SHA512 e25f45f0246a45056171b0ddca5403032205b8b41deab2c5345e3439c7eb7517f734437e7597ad678ed5f85658988d570dc1387e8a4958f3d80fb07f2153ab4c
SSDEEP 49152:hVhVsoRb7ZsgKdjzNrMAXduk2cRoWOHjx9+hGGGyaHqaEFWc/TySx1GEsPB+onCe:hLVsoRb7ZsgKdjzNrMAXduk2cRoWODxy
TLSH
T179853E78C89735703BA456BBD92B72AD7DFBF3786E8070B221DD7924E2CC51046D4A28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MEAY.exe

Path C:\Windows\MEAY.exe
Size 1.6MB
SHA256 a0051ac6b9fbb3390dd182bff06e39107352f746cb04aeb47083fb4f21a80627
MD5 605567c684b6db55f6f4b645317e4cd4
SHA1 cda9f71a55352768bd939a1b613f609f1cb84a0b
SHA512 32d76a42313abe9aa3391cf015795432648162df40cdc550fd8a790c8f58c39da6cda9c252e5b2cd95eccfdc84d830bb112dd6631f1385cfccfae140b694d2a0
SSDEEP 49152:+n0lVUPeIwYlhcIwjoJQAWOjjfoWUXt+6+PKRbg:+n0lVUPeIwYlhcIwjoJQAWOjjfopXN
TLSH
T143757AC96E931BCA74DA58C3EF4204EAFB93B1D0D1DD94E8E3630959F6E34A08D2558C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MEEg.exe

Path C:\Windows\MEEg.exe
Size 1.9MB
SHA256 cb34727a9940576d5b35f1fc1e3faf45fa1ba118bc15b5ea6af147c958141101
MD5 fd37c28f49cd9009f812d7a30415d6dd
SHA1 8ba755d446dfebcb7b90464be62f964c0a9b2bba
SHA512 ae24e2fe9dbc1c4833ad86036a6d2ad7421513a027282fbb685e8462d982a5cb7e1404c8cd981d61ea327d093fcd1abdddd6961ede30797aee30ffaf27641384
SSDEEP 24576:uzolDq6lmNeAl8MwGEIoyzC1je17rUoSuofjV3ncY:uzolDqkpE/1EIoy4e1vUoSxfND
TLSH
T12495FA12524F229F46320E743BB704A7AF37636DD3F4DA1214547899B8639FDD32A28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MIUc.exe

Path C:\Windows\MIUc.exe
Size 1.6MB
SHA256 213674281a4e38e929cdf673bf8d19f7b8c9c21bdd1857a308aa860aeb6da721
MD5 cc7f773de1758428c61b7fa0097ad69a
SHA1 d52d3210c3ed2b3e8725e08306b002ec81f7e1f7
SHA512 d6f1ffd7466a9c25920588a1d93eeb802dc4e2f59d64edc8dae2fdf7f6d4821a1158c8db7b9715a81a0728d70d027cf2abc344ac9388683f1e8d6f129184e7dc
SSDEEP 12288:z7xdFxQi/Rc9pjBYD4MtasuoF7ffvMu+EsTSoD2QGwH1gwQnkbW8laL9xTYuCz9N:z7xd/Rcv79oRffz+Ha7o1gDnk68UK3
TLSH
T1B57546FD962CC1C1BF989B0CA641815F44793FF91FE7D10ACACC285546AE3A51B43AB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MQUo.exe

Path C:\Windows\MQUo.exe
Size 1.8MB
SHA256 73a8960b6a1042b93330796dae3a3490b84c7ba65a21d090c129172e0985dd74
MD5 f88e79435d0ff61e0ad5f07fd71bafea
SHA1 e08a3f4c55ed6bcd4dd4f1759468694ef93d644d
SHA512 5b3690a5f582e882e927b219f802a0a19bf552d349e36d79dc453cad4b07327a5afcecfa72c4600b79932fb280fe61271e3871634a5d2e94917ffc02aacf27db
SSDEEP 49152:O///////////////////////////////////////////////////////////ck/q:lakfJWUJ1gz6
TLSH
T1C8850F87B0E36151D7ACF68DE4825960E2F3E932C4441E05B3AB4A1F8E79DFD06CDA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MYkq.exe

Path C:\Windows\MYkq.exe
Size 1.8MB
SHA256 03a56e0c008025d5bd302d4ce59be6b8be10cc4b174076c0e781692032ea8580
MD5 371fced64d87912fb52ef96b3787cb90
SHA1 5c04e86670e156dbaa03d71d423b887b0574e296
SHA512 9e2aaa43bb82fbf98b1e20c9547d4b1b066827c45244bbb288880b55d3314c67204d1ae74f99166f3095412766f2452064858329f2cf1d54c43e011f988c8349
SSDEEP 24576:JAxlLv7WsEHa8mBJfBByJHXnSqvS5EnBp3DM3BQqgmCHPHRHlRkR/GaXHncXgN3G:BQg/T/QChecc4AX7E
TLSH
T14E95FC009E9D950DEAA6F577F34305CBBBEA8FA431C12578CAA70BC37909664C27D61C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mcgc.exe

Path C:\Windows\Mcgc.exe
Size 1.6MB
SHA256 6970ee877639a930f6d67762843d81e75ad9251b5bb1ccecdc8a6ffbdc44f434
MD5 fd789b5918429eb7b7d09fa1f083fd25
SHA1 ff2c736a60d1d33bed0d5c0d1e03fafcb902f4b5
SHA512 8cf0a9b9ec4c14e4d7b4b9e728a43b929c1c045e1b3254662276d0a4bcd4bdcaffdfe30b7bb82e80bf03ed40e5df05e4e152eb8f92455d4455f90dcf7324ac82
SSDEEP 24576:Krf9UlEhgYv35PZG9XTHF+hBPNeg8TjIFdYUWF+wFsr:Krf9UlEhgYvJPM5lT/jgdYUWo
TLSH
T1417501E04ACA8F2821F6F908F28E1D7D88D6D3EE605B1F97563DF65E34B84368124359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mcoo.exe

Path C:\Windows\Mcoo.exe
Size 2.5MB
SHA256 09f7536116fde81265d724ef78fb65cd6ce67de80d6b1e29d0848a4797f28fd4
MD5 0d1152acd670d1e5a9cc2f5f6f17fde0
SHA1 4d7125ac8039a30e04fd2c0858d7e45eb801bef4
SHA512 1390a3a74642aab333c8341c870c648a806b23c069f54ea24faf1b7bc927c30561e06d6f86a15160892361c77c97b3d0f9754ace0643b4be00a3aa2c066d5883
SSDEEP 49152:42MSDo7iUduwkOUz48wmN7fLg2lSWl2pkn5dyR:tuANz5h2pO2R
TLSH
T158C5915DEDCA876A8054D164865D140A2830817B3F48B97EE318FEBFD33A76CED23865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MgQE.exe

Path C:\Windows\MgQE.exe
Size 2.1MB
SHA256 037b3e46eb5647f70f8672f0a271dd7e4e3f1fc1343ce995439cdf7ed02c538e
MD5 4c28e6fc5178aa5a938ed10bcd67ed3b
SHA1 3c89a47305b84e8c27314f902d0d0cc432d91704
SHA512 1c54004824fd5f80af626e9537629cc03a89c6105e2b685973724b0714fdd628349bd0bbc8bf78ffa2922eed314982f6c56773092ff8b4e96d65ed20da075364
SSDEEP 24576:swefoepToOf0g3pIVFF0d+dSuLa29R8Fqo/HqWry8jN:sffoeFooIZS+dja2sR+M
TLSH
T1FBA562A4737AA4BA161E8B2F9FCAD3043CCDF479C522E834ADCDA228B0C1455E45E75D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MkoI.exe

Path C:\Windows\MkoI.exe
Size 2.2MB
SHA256 8b728608602a881ea5d0ac275a1b66d6987d906216036f19c8b5b43e104d74f7
MD5 ecec3886a9eae0fc40cc4901b365c2ff
SHA1 5678f25a38e3660015ae93d77bf96ad18b5b63ab
SHA512 13999d99f458c7c1207bdad05015a3fe800ac289a06610dfdb79668363926d2c0c355f329255c41f2c04b5e8aa942c1d9bb8828e2d877e64f45649866b17641a
SSDEEP 49152:aFKBeUktMtnKSJ6qvgB0cBJxCVIFu+eQt5vKXhTFbpVvjF9S1S:aFKBeUktMtnKSJ6qvgB0cBJxCVIFFeyz
TLSH
T162A5207E81D9BA4996311C32D4B888FCDE3EA6465D364A9607FC1FFC29E3F8A148C451
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OEsK.exe

Path C:\Windows\OEsK.exe
Size 2.7MB
SHA256 89cae5668fafbda2bbac52c0a2041d2599209b9aeb3cf126fee08c06ac51c5c7
MD5 c2d658c17f126b94f6288dab95350a45
SHA1 1ea22a9b5f22f8ed2135f6b69d5b73d93da0ae9d
SHA512 bf2afdfb02d1ef6b9a4fcb81895a3d234f1d87264947b0ebfb1d560a91ffd342c0ca79ea340fb20d539b83ee5285eb9e0a3708a8ccd30617f489793bf589c68f
SSDEEP 24576:RwRElH+T87QHwWA10U/3VNQ2YKHVc1GUDvNAll3VRT0O63eP0y9xcTail2hGG4Ha:RRleTlzA10RDvOTl+VebichAWAQdV
TLSH
T169D584B7F011F3410F5077368217DEE5A532A455F32B49C66AE9A39FF34AC9A926CC02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OIMK.exe

Path C:\Windows\OIMK.exe
Size 1.7MB
SHA256 2ebc81b2e299f984c9e18778e40627f58816ee2cccbea61f9a5eadcc7c5ffa74
MD5 2b3bbd058e2ea74302e6257c20201c9b
SHA1 d2370158259bc6f344cd111e0fa51ce913cfbc3a
SHA512 1116e5cb4d46f79fd1f87cb64622bac6815937a8d820c3b90ef84ec6d0af8fa52d34a3faed0f3ddc668fe13fe99919110e778073f7e4fd02510f3475a5f80602
SSDEEP 24576:RnEo53EDwGhuheXKJr0WsEzcEF/R/w06Z6j2/L:RneXKJr0icu/R/wyi/
TLSH
T16A85D8DF2619E40D38479BB2EFDC3D5A7C9D7904036F4A451F1BCA47812E40688FE9AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OMQg.exe

Path C:\Windows\OMQg.exe
Size 2.1MB
SHA256 209842ad920d2e68d849c65a014381f7d913f0f805abad1fec7951753416e80b
MD5 930aa560c7969c3c92c3633a794d7792
SHA1 4611e422ba5461a30c09928215fae80e5f03db45
SHA512 daf83c4d1fc2d2b56255bca7daf1af2502fe54372fbce650dac8c711563d5627e01c7e2ffc577b62453063f515175823d38b41c4f2288ec55c66f2363a1f1dcc
SSDEEP 24576:HJsJ5GLOHU21w5RiLfvizZ35TD8/Y9M/SgHgXKmRKnSv07qFhE69ZoAUU5WP:HJsJU6OzR5TD8g9zXKmR5sqbE69O
TLSH
T13AA570761E7320ECBB6E4133C741722116879B8B937442DB442B1A9AF94E3AB395CC77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OMoG.exe

Path C:\Windows\OMoG.exe
Size 1.9MB
SHA256 ee4af2e28e78d484dcb5f3526df3af96c1744f230d53c391c65d72d55c465388
MD5 eff16a26263f19a343f821d48a3c4841
SHA1 c070f6f48bfff29efada24c1aa34c464a5d12a80
SHA512 b08c730dd110504d21c7a2039c90e112ca8dc3da5f33b09e69b6d98de249e714cddd0e323c16298c980b949cff16e61c4bceb09ed44dbc46b5bcd1ca09e0641e
SSDEEP 24576:ELsJ2nKihHH1M3B57fQbGoI1v2KjXzThoDADdIXQJ9e5JaFE1UfsXpVShQm8lET0:EAJCAAgUs/YEPLmeHax7+
TLSH
T13795D7F329AF06597977293C64DCC12D52C249FAB110B0D98EF81C8E4A5DD2CAB4BDB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OkEO.exe

Path C:\Windows\OkEO.exe
Size 1.8MB
SHA256 f1260cdac88b81d0ff2297f482c794fe7c2b24e3208301e75ac0ba5a751e9ad0
MD5 89edc3d0f634d14fc91991f613ba2015
SHA1 d20139966b6c9aa092937ad949b96f1a1a87b099
SHA512 8f476f274d793f81d419e540831dcb6dce7123b56df397f7a0c7e617edda9e760fd9c35fe4e26469307ac277b2f8e002e41e3c053cb04ecb3843d720728d0ed0
SSDEEP 24576:wsFl00pZeCpQlcMMHcaZRZnEXy3T1FbGI:wsf7ZLpQWcynEE
TLSH
T134957681686749C4387C8274CFAB0F9604BECB84B9DD3414BF9FF65866AD21C952F263
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OwUi.exe

Path C:\Windows\OwUi.exe
Size 2.4MB
SHA256 b90ec7b5c33d6417c0964f4cb8ff70eed7b513f2a2e824ade08c53b3fc3089cd
MD5 7e2915f2fb468e6f42fba2fdc812e9cd
SHA1 87d3cbdeddf5f60f8fcf270e95a795cc595cef60
SHA512 a2005c0bb911766851424006c8367dbca71bb14739aac5da96fed3f13c7c10c81a2869dd6bb936752b7793847cf20dccc667f1c06fd04e9ee760631b8e7e2101
SSDEEP 49152:X9L+D1iGCWp065lOkI8zqxUUFFFnvi6lp1rb:N5GCWS6if8zzyFFnviUlb
TLSH
T1C6B50C0A44EC70142D5DF2B87F52EE6E60F239628AE96BF06CD63BE1D5375447D88C0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QkoU.ico

Path C:\Windows\QkoU.ico
Size 4KB
SHA256 9a233711400b52fc399d16bb7e3937772c44d7841a24a685467e19dfa57769d5
MD5 383646cca62e4fe9e6ab638e6dea9b9e
SHA1 b91b3cbb9bcf486bb7dc28dc89301464659bb95b
SHA512 03b41da2751fdefdf8eaced0bbb752b320ecbc5a6dbf69b9429f92031459390fe6d6dc4665eebe3ee36f9c448a4f582ac488571a21acc6bba82436d292f36ac5
SSDEEP 12:su7zfhIVfhIVfhIVfhIVfhIVfhI6I6ItLUIUjajajaPcIUjajajajakfMIaITcjx:su7zwwwwwIZTLDGPTOBdcjtjmjFj+RIW
TLSH
T17091B79E538B5C34F95057F47AE5775296EBA60703CA2D2428AFF02E12AD9C17EFE040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QswK.exe

Path C:\Windows\QswK.exe
Size 2.3MB
SHA256 05b87c135d74289589c2fe18cf9f77b69835bf508aabb8ef3d2bb88aec3de8ae
MD5 25b240c9c0635a4cbcb2cf74970e15d1
SHA1 8af87a3203a7449fb2bc622902f3511f888a5582
SHA512 cb469bef17401520875eeb78058a74a792248ac108f911541f1e49469d99b0ed415ff1ffe678e9081d8743f0a3ead08a511f2f9998fdfd08d0233fad9af78fd4
SSDEEP 24576:We7pXqn0UEREUIGtBmmfVjnR4B0eS1/PjNmsnUbb6kEYM5ykD6uiKsyIM+EnS:WAXsGN79R46eSZJmsUbctHM
TLSH
T13AB5606576F5D618F2BD37088FFFEDA16DAA53A76FDA3D524DF0068A08F12909E48400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SAcS.exe

Path C:\Windows\SAcS.exe
Size 1.7MB
SHA256 22ac267a6a027c6b9d3af9e299fa91354d56a4bdec93cd5156db8077f8528487
MD5 370cb5ee4689abc8f7bf1d8e2844fb78
SHA1 8862b14c49281bd4794a915fb11dcf050f4b61b8
SHA512 acb360776fcdee5c959028a003140ee133cb6e4385c63fae277325849be05e639078272f6df2cc520d3afbd33ff95ecafaccacdf4469aa7c994f084ae5bffc4b
SSDEEP 12288:X/bShT9mQlIjJevrC7jpQjhfNQnQtQgILCEXy2tgmq0R/LtlSgxgB3rbx3E3HsF1:XuhT8crygD2tgaRTtlXg9rb5PRwbyvR
TLSH
T1AC85FC14C69E5B6C3A6BD0C1C84318DBCD1C3E1C5BD6A5B005A4FE50BAA9234DBA7CF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SIMq.exe

Path C:\Windows\SIMq.exe
Size 1.6MB
SHA256 6ee2d7508663f2648fc78afedeb78a76fd584bebd3ec187967d3ce4cf8f157e0
MD5 cdecc147c20c2b75fe013e8dd95fa4f4
SHA1 50d5661c51e0be07dcdf798ed3b75ea83982f1fb
SHA512 267d3d524f0cd05618589618a32b9b90b866621a83efe08b6daed213a4400630e35248c7917932bba393ab23eebb4a9c304426881410f6f2b55db7d0f93ac3d7
SSDEEP 24576:XqqqqqqpWccYVfhgitRay+y9EqHXjxbxM9etoJ6:VDfgitRay+y9EqHXjxbxM9
TLSH
T11A75356FC1B9AEC45A1544612F5B0CDF6009FC2977836A0C3F5BC2B6C6B69CE36E4660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SMkQ.ico

Path C:\Windows\SMkQ.ico
Size 4KB
SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
MD5 2fb613374fd9eef57a03c8a2d2e52d8e
SHA1 345eae2c0189099b5367e22315b663fe6d037232
SHA512 74ed79d3db6211b1bbec4ca6003fecc866d84abb38987fe4a442558a520490797bf0b54c643b6b4bfc687b3be56d011e204d89166cad33174df82a86fb036f99
SSDEEP 96:xguRJDhHREoYxoJooz1oj8vJBI+L6Y1X4Ni:xgZb+Hz1FaI
TLSH
T14291E5E8D341C55FE0E98B77C2360C77E2ABDC6E8A79896E024C31D27E31643196690B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SkQM.exe

Path C:\Windows\SkQM.exe
Size 1.9MB
SHA256 4cd5a36fde958cbf7a5f41c91cf2e0ad3a7ecef9397c6ea69ed49cf445be34d6
MD5 6b40374f3caaea22dc351671a4be6313
SHA1 5e0d875c839e85ccccfd610020f27165422f2f62
SHA512 4eedbbf6e8f4160ef508ce225e95cfeeec1c36e8b115dae892d656080541f140e6340b065d4b933b1a9f37b143d20b63a6b23e30d97c86ebf21d0468aba2d715
SSDEEP 24576:iso13lDS5pvBQanun8y9irzkDQjDyrB5Xh0+L:No13xS3vBQanum4DGDiBNh0o
TLSH
T17B95FE97717738E1BFF04D96299B7C98738F7C3D8B0D741A3216A481D84A7690E6A0BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SkQu.exe

Path C:\Windows\SkQu.exe
Size 1.9MB
SHA256 15351fce5bef02dc39fc86dbf3661c0cf5beaca69d8c546546348b8e13cc1e17
MD5 3333f23d54296d9baa90ef9c7f1372d5
SHA1 608bfc430b69c78f6d9e8881efa90ad58292d528
SHA512 9014b5335e0ba987568bfdb14b0de89b53bd1db4b8a3ffa946a9c0a09cb50819d5e952bebe892fedfd12adb9bda62485082847358e63f6951735a326554c1c92
SSDEEP 49152:67eQtyM92NHVYl45iPswRj83vl7uqn9cviWso:V+r90Y45iPswRj83sAuiho
TLSH
T17095EB22B065882D805B6099F593AC24BCDBCD6354CEE25750F2C690FEC8F346D6A9FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Socs.exe

Path C:\Windows\Socs.exe
Size 1.6MB
SHA256 a0110525fc97b368cb268e109a7c8c23976924f8466c1914c0ae54ee538ca777
MD5 7b9772f7064a41b3411c340a3d0f8c0f
SHA1 5fe8a3776ae58bd48e48f9a4d0565b9662125f05
SHA512 6fd5ee247ac760add53ad0ba8ec336de3704c4b6bfa8e3476603f7f8720b822b921df5bac819b368a835ea596c6dbb16ed4672952572866abc1ee7b912629d34
SSDEEP 12288:oLptGCBAr9hEem05XRP5CFX3AJKVhO1TKy9TIHWpM6fpmPMWqayF/QVmk6GXe7ET:d6X3AJKMJXuM1zs4IMAnhO8TuB
TLSH
T17C75360F666D972760E03FD879B32EC292CCD3294F2D56136E0FC82E9589488B1D65E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SooU.exe

Path C:\Windows\SooU.exe
Size 1.8MB
SHA256 236a64911c6d72609924fe6c86c7877b9cd104e6bce27f7214061f9ed97835b2
MD5 2e3410ca318335041bba507eff820d91
SHA1 9d2a0711d430ca102b33189e6a59c569ce28595d
SHA512 dcd12e81c03004184782f87175c551620f6e5debe8568119b636e1ede2f80d63acc86fe4c91ae3044904602b4f2816228dc533af74b2d162bb29dc2eba63d189
SSDEEP 24576:hvnyYGU7c9Uc763VnhlBDPYgA1lL8MP/eQkRkC2y8sRy:hvfGU7c9NWvlBDPKx/eQckC
TLSH
T1E185C67B62432F9450037026E5416745CBE2E1897BD0A3DBBF8317F1E5E6A04EA336E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UQIq.exe

Path C:\Windows\UQIq.exe
Size 2.5MB
SHA256 1406880abd190c17628c7c093621a4ab3804f4806ae1078d9e8142f59c88e01f
MD5 b04b1749fd083167dd192f36c697f02c
SHA1 6cfd626161212f03af168c40b26406325ec9da40
SHA512 b36a5d40c991b9f2508f40c7bdc5e5d6fa812f08e9b47f2644424f5f602100e03aef2c866e1393f0fd2e9e3d8f9348f1055b92aa840395b7825c4882c38a107f
SSDEEP 49152:F1fJVOZkPCMbzhehU6+l6+kqP0NwKJikNtxRK1eJ+rrFtmrs/+:F1fWk4d+l6+kQewaNqDrys/+
TLSH
T18DC56242D467AE158C3174C18B9CD0432869FE5A6CC664A8473FF83A5CFB5DE4FAA42C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UoEM.ico

Path C:\Windows\UoEM.ico
Size 4KB
SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
MD5 c7fffc3e71c7197b5f9daaea510aac10
SHA1 23262fb8038c093ac32d6a34effbede5de5e880d
SHA512 c3cefdb76a9fc74299a7042096a549e019db3f2cf79e81deeabab2f3ebf2bbc9f2924a84cbbbc4848a4bf84cc3a0886c6c738c6bb37c9140dfc57f1f797e9c1c
SSDEEP 96:tzwwwwwwTjHjHl0lzjjbl90bl/j6EMEN0jHjHTTajtjmjFj+RIW:BTjHjHl0lzjjbl90bl/j6EMEN0jHjHTE
TLSH
T14A916C3323480D35FE550DF4BCA6869CD088B21447CB2D985BEEF99E707E8C249FA480
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UooK.exe

Path C:\Windows\UooK.exe
Size 2.0MB
SHA256 b0a9ab46321fc7dcb20f71b0428d3c4d6c99c4dcd4d62023dd705f043123ae7f
MD5 4168bb2d86bb142332f6f7d84da789f7
SHA1 df7e6699d0fe57cef012ee7995ca08b646f090cd
SHA512 0e98b6d39f0a1320268caba95020b17c8bc5699917768a2be5f7a901dd4e48f0dfef8e2af0d20a3124bae9740cd812c9499d4c98a74ca39fba35a762cc5b0f7e
SSDEEP 24576:lONunc39RuI3sntPHLAvAAZm6qdApPobsqRllCPcX:kj33B8tkvD4dApwz3Ce
TLSH
T1AEA55194D8AEEE45099B166D955709793FDDB060F0887590480B40BFD2FFC2ECA922EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WEUW.exe

Path C:\Windows\WEUW.exe
Size 1.8MB
SHA256 956b1226fd58a4473f3482e9716d7cb35229339e5fbb2d1417ba1e3e448844ff
MD5 ee37bd340e6727249e239ccc695b7fb6
SHA1 5d0079749df0e58e67bd2ada83f7ef3126d573c8
SHA512 8940990b51de18febf9f4f749528e5d9c3691bec81808ca2c029d099dd6ac3f5bd9948bb2808042de035236ab0bbcc2b62801cc8dbf497a54dc003ea64459a99
SSDEEP 24576:IyEEchrsjfzjBNIX+mDYwaIFY/kuGOyx3YqVg4R0aHEwQR9:uyNIX7Yj78uGON3K309
TLSH
T15A85FF61BAD71CFC5C36A89D1B6E6C3F16C0C2D8F01B7A376D2715A2348B0B7B561A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WsMK.exe

Path C:\Windows\WsMK.exe
Size 1.6MB
SHA256 60cf49d046e6f3a6f09056eb93b21001bdcd40ca8b56a35a236fd60da34d1d62
MD5 fc7017ec2d207051b2cfa43bea84b794
SHA1 b30add70af9a168daa64fab96827ae4171fe2e88
SHA512 9351b1097489d82ae50b6b3657f6c81e1972893d2381aa11ea86dbccf261c294358f57dc93f8b7d44d9897e863be5c0f1e18ef147359a8c03ed56dc4b4a2f1af
SSDEEP 12288:f6QI+XNWz/ztwXk4T5Y9ghFjJ0VbSocU4KpHSTBAFV7eIUjyO3EViB:f6UNWP5IYCbcGhTKoTSS68VB
TLSH
T13F757436FC34C1781478ED96AF19907EE6199FC8A123F106EC2D2D8C20396B9D945EF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WwAw.exe

Path C:\Windows\WwAw.exe
Size 1.6MB
SHA256 3fd1ded81ba4fab602e25b12719d18ba6d530604e7c50e97f8fe1944edab985d
MD5 10a7e840c4eceb86389a9e98378aa71f
SHA1 3444ba5630ac512567241db88be5e7c81c141f78
SHA512 1ec78b71c979566503b0f5ed0bdf4e1843dd6e4356b27cdffb32f38e2b4de8d303adc6ca07ae35c52179d00389d097c714553a80d9693fb5a48f6aaa7b14d53e
SSDEEP 49152:zH2BrF8dh9GYnAMLoyZ4hJO1EPT7qr7R1zJyjIkH65que8YP0ZAQ8vwa:zH2BrF8dLGYnAjyZ4hJO1EPT7qr7FyjY
TLSH
T18B7555CDA92AA269CD57651AF5A8B184BF8868E8F481F0756BCCF60C1D3334B46DCD1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YAos.exe

Path C:\Windows\YAos.exe
Size 1.6MB
SHA256 0eea1bb4d924a42c56822ee6be4c7534b92c66f634b767b76cc668b32d035ecd
MD5 c9d5ac96e9ee4ab12a7a41902dec5bcb
SHA1 1050445356c5f82e94b4338adb2866e252575d09
SHA512 f3eeda4c23c82914de85b11deabb317fd8abc9a6f8c8214bc00185b48fb16969f1118a7ba129c186d4609c954cdb23c407476fb0e537a57d925208537c04fd60
SSDEEP 49152:go1R2ME6Z8TvrAyihZU2/u0+oMS3xUQAN:9KM5Z4jes
TLSH
T1BE759E2D3562CCE43FC55522BB82804B57F9AC445F96C42650BB23E79FCBAD7072A0B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YIMc.exe

Path C:\Windows\YIMc.exe
Size 1.6MB
SHA256 a44ee18c47101e1e0d58eac359369ff7bd2b22dcdda36d98b0204fd11b75d090
MD5 a85d08910a72c80962859ab4a3a99822
SHA1 b61efae275f66400fe2bad8f7e6f4e6ae29005e7
SHA512 3042b7d57fbfa9534742b0723674f795bc0739e75ad2374c6d412c62b946fb749b6473b1fa725f2c2d2f9ab9fb1c9c77a35558d8afa6326f03518b4721d475b3
SSDEEP 12288:B4jdvfpypYNefiquTIRAojOia9A6svXQOuLIyHb2N0AP3JP/pu4mqmVOc8Qnl4b6:BIdvfpypYN5Ea2ORA6svXib2XEWnIO
TLSH
T12B759847461B196F230B6AC4EFA3EBE66058CC90DBEA7530DB0F40562B0DC397E2D569
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YQMS.exe

Path C:\Windows\YQMS.exe
Size 1.9MB
SHA256 453d3deab6aeb532842bfc6abc3835f6484a6c577a6c7c560fba35648b3187a1
MD5 b390be732f945f4da49cd6aeb79325ba
SHA1 8ab2c792f87a203d73424d7980d720e5f912a3dc
SHA512 836b074a2a917c0c9c40df0d5d54223749d53380eb1217a948b3184d1ac4a9093f1fea569ab84aef168a9a94aac5cb1f02bc37d465401d55a8981984e400ebb1
SSDEEP 49152:PefCY95B8ZvBvhl65C5TooWWR4dyl5pHt1wZ3wbKVpYezeYbI6cT46j36ofYZc5X:fxOZ0ydi3Se
TLSH
T1AA950B63E71360BA6BC2756EC12F37067ACCD29C917646AE7E6006C08D1C6A8DC9C5FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YwwC.exe

Path C:\Windows\YwwC.exe
Size 1.7MB
SHA256 6fad783b33879421639729ab75354bedb1b34f8a929a7374ea81fb89885e3dc2
MD5 2773193413b04fd55095df0f577cefef
SHA1 c16436edd87d6017c5ed2510eef036e73be5ad4e
SHA512 a14be71d583783c7583eca99c7d086c13ed955199e97fb680c5f1d50c5f11c5f3719e62d35cbb042fd1a3fdd9f9a75c8c60fc722b49c0ebec2a83c748d677b2f
SSDEEP 24576:m+40ojRiIFaAckrNk5rx+IpBHTZ+GZuKQsU+WQZc:iRiIaANsx+IpB1+CuKQsU+HZc
TLSH
T1A285ED16C3BA6DD8D58045F18DB4C66AAE9438B13E3E9B882D95535F82F3DC993D00EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aAkS.exe

Path C:\Windows\aAkS.exe
Size 3.0MB
SHA256 6603a0a99e48a5fe4e7850e28bfef3c215ff54e6faecf88a6e997f2f597b49cb
MD5 64a0c0f1a9f75c8be440be64e8eb5fb5
SHA1 bd7fef2cd3e99b2266918ed58cd349bd00150916
SHA512 2729e8df10796f760883b4ce1e3e3f3ec9b6c688f8cf414e850d0472ffe4e5fe9491244ef57afa075277e8569f3a0c78a2c45a1708e20bdd8b8074a4815c0c4c
SSDEEP 49152:plglhu6nmWslwuUgxQAwjJaS7ved2zx1hF8gDptg4:peDRnolTVKAOlyd2zxZzptg
TLSH
T1A0E581A4573F6A2EC1C77A943C6C5084739A9ACF8F39329FDFB1515402BE87AD92E404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aGks.ico

Path C:\Windows\aGks.ico
Size 4KB
SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
MD5 1a2d33f9fe3680b4c77b4e7e10fae125
SHA1 189a13aaccabf7608e8ac96d3f43229784398d2e
SHA512 e62171162ccf70d3e51b8c968b435308c435f8165eedcf0f1ff36816b3263a4c65049130fb3b029123cf53214c1d62fea358e39c6ef929c94d71e3baa308ae38
SSDEEP 96:xb7u41udH83HREoYxoJooz1oj8vJBI+L6Y1X4Ni:xb7ujcCb+Hz1FaI
TLSH
T1C4912CE4D345C55EE0E58B36C2374D37E1ABEC6E8A79492E024C35D3BF31283196694B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aUcu.exe

Path C:\Windows\aUcu.exe
Size 1.6MB
SHA256 1a4bdeae86f70d87bb41032b5b2f5807f58021957ef42c374ebcccb5fcf0247d
MD5 267448de71733cad1eb2ea62d0904aa9
SHA1 1d00468de3a413233bf67d24d31099a1d6e5f0ee
SHA512 36e4f5a3239b2ef0b506bf2c58cb6ab71e5f33436162cd1ae0bc2669cc498ddd7b36bf92584b22671081e3ba0276cc65505b03232e025e33a577f30b56989326
SSDEEP 12288:e5E1ls171gKZHDGkkfwiWs9yeebFhyadH08MHpD2Cx6QuNc5W01cdb5F0ULwId3f:e5rRG5fhyOCCh1cF5F0ULzd38
TLSH
T1B97586AB8CF702415D30709CE4660B169D67A51D81D2AF2BE0861F1C7C68ED2F592FAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

akYA.exe

Path C:\Windows\akYA.exe
Size 2.0MB
SHA256 c2d80b82ce2c058060848a82620a3425d78ef067ffc8ea1adc182aa6861c331d
MD5 33034b7c31e331c89f05b518ada5f8c4
SHA1 4a425e90bcaf0944a0c8ce6dc1d06433319e6d10
SHA512 51e001e0849f74a00eb748f147ee02edf0472d0c97d6fbdb3190cc200e405f2d8461226a9ca07c772a52656987b3cbf9cd3a7b67e06fc5cda42b0762711a5049
SSDEEP 24576:MgB/b6byNy19qbTfkegOEOA2Q9RSSCweF4RCoKQHj:NVXNA+kemOxQDJEEKQH
TLSH
T155A53114813E7F91C9E81997E1632BEB7E347823F929E060520A916FD51F68CD09FB93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aksy.exe

Path C:\Windows\aksy.exe
Size 2.4MB
SHA256 e3982bd746b13be6fb7b8cb1976e4c3ab20127263f17f09fe0328839c5dc1067
MD5 f5c441d4796cc9d7ce6c1a54512f9531
SHA1 f4c0ae5ca778a019567f423fb7304fd1aea58622
SHA512 68bf7e86bd0e28582cee3e42fef18132835e32f0e7f3a8f267c4baa8e41d85c936adbf369439dcd10bd4e366b9ab6b206208d6cfca1916e132343d8bea55791a
SSDEEP 24576:Z6IGw2CFWOGzE8U6xyiLJIi7nhJoH/dL2e0HotI2bQay4f+vD60gWBYv3fkuKfiJ:32eGzE8nxyiLJIeqQHwI4VMD605iJ1
TLSH
T1C0C5C5A9D193407440F458A22BE1648ACC246736E0D39F57D3FECF63E6DE23943B6899
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aoYc.exe

Path C:\Windows\aoYc.exe
Size 2.2MB
SHA256 c2b9dd8ca6d2c2d4363e8f400a0d93f246ed9834db3543b7272e363b1fb0f859
MD5 18b9bae5eac50f08362da23212990c81
SHA1 17d15e3fa185690b1db04392c2d6de7462e2257a
SHA512 246564771bd7f889d4213f639e66fd4063d43e38c617f2caac02383a9ca092a956b094f966d0bab40d2c4ff9839648ff1b3850b27a632ac5332095fb28b9e769
SSDEEP 24576:zlDGcrqXEYaLUvJWYRGnXLx3zqdc8FvM1ZBEpSrHBTy/hq7vvfzfcb8f:z4XERAu8JQZBLty5q7Lfu8f
TLSH
T1DAA53F6B766D65610A2F5C25FC11DF43E17C078B7AF21AB07ACE3098E28A372458D7C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cQIk.exe

Path C:\Windows\cQIk.exe
Size 1.7MB
SHA256 7c6c6e8e9685be47c772f68762b563f46c9dfd1b838a77c4f22273bee78ab016
MD5 ba1aa4b85cd15bce8d1d33c6a211b82f
SHA1 5603a4238f7bf29deaeb41959687ed908524729a
SHA512 b3285f65ddabf5c01301d6b6b6ec0b49ff05506a9e7ce9a6eb824d055b2e714dad1c5c397fc37a2d0dc1f838d8492cce450381d7a2f2191f44c6b727d651dff1
SSDEEP 24576:F5+ArdpN7w4Bo0/pQnuIYH+h4swoXRd22rnXBs5ISYZcf:F5luFh4s82bXKCGf
TLSH
T1EE85DA8193DF2897EF317F678941FF8456689D1A3EE1DE2009F02A4F12EE8492DE4179
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ceww.ico

Path C:\Windows\ceww.ico
Size 4KB
SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
MD5 f7858e48b74b107ab160878eb400128e
SHA1 d8cdd8be514077e101a9f0a0fdbcdefaea6aa72f
SHA512 c2e950c96da0c901c550dddf953dee3eecbf9a1cb509100c93bb034351369e1547bf5b97d4aad78e2bdd516a09ea28e999e597fb0a91fb350da7b7d3ec08e9d7
SSDEEP 96:tzwwwwwATljxEbfbqacJHTTejtjmjFj+RIW:hTljxEbfbqacJHTTE
TLSH
T16E914A3723481C35FE514DF0BCAA9A9CE088BA1887C62C546BEEF59EB57E8C209F5441
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ckku.exe

Path C:\Windows\ckku.exe
Size 1.7MB
SHA256 ff072ddb69c963ee9f0c660b623e25606a276b8c9af7cb502e119c1b4368547b
MD5 28564efe7b7a5c95679ab3c2f7015419
SHA1 a89b16daf66debd776db9a1bd9afa391e3d6376d
SHA512 431b2c070da0b8a48a6dfd52a612337ff616b17bbd168f1af3e1434b5c47f9c91a9d16c1b7562ae35eda65574703c4eab160197fedb8d419dd32bcd8e3753462
SSDEEP 24576:E0n7yF9rLHcJtnDvJke/jaVNZN/X9pej+lvwVuRIgSzVzOhz:E0n7yFdYJtDmpVztJsAQzOt
TLSH
T1EA850DBF435C8F606E51BEC6CA0EE5E5F9A203E688312F6ED205DF185AC1A7872D1705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eGAQ.ico

Path C:\Windows\eGAQ.ico
Size 4KB
SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
MD5 04e9ffd28b9cbb9ca06e99dfd0c7878b
SHA1 44d1ff600e81c6014965bb30684eed29ac7c538e
SHA512 22bf260e1ab53d90c8b3083cae8d9fcfcf6ee19fe30d61c6074ddf38823afa4bc6bd738441bdd3e221131f4e87a750c03f64ac78cffa5648cba737c0c623d888
SSDEEP 96:xB+p+3sHL25ogAJpogoMotGcz55Xxm/frxO1Q4Ni:xBK45LAJprLq5mCI
TLSH
T1A1919C6DD785C54EC0E94F76D3364C77E1679C2B8E79986E024C31EBAE321860829D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eMkG.exe

Path C:\Windows\eMkG.exe
Size 1.9MB
SHA256 f2144ccbd26464f7afabe07467c2222f0329b72d6aec8eac1eca9cfe4119f3a0
MD5 47f975822e1dc3110395c9cc917e9bc9
SHA1 bb4f18bc59a5581737cf2d184135dcdf71370d5e
SHA512 90e1c128431c57f795b7304568210b8dee1a6bbc4332a37420d934766926783c69970a4d00d8f5f8d94fd6ee5f00feb0abcf3d87a88a1bb7df7ad493d402440b
SSDEEP 24576:qSFzVbTo3X2eEtIZECTybJVT8WuazmhxXb2O:qSmGJtIZlQbwW3
TLSH
T1E0953055897924038B56A35BBF562EA39EB09FB3CDD63F0938833EA1053C898933157D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eSYA.ico

Path C:\Windows\eSYA.ico
Size 4KB
SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
MD5 6e9325e46193ec554308cdb9ec8a9cd5
SHA1 3e3c4a52ed1fd3a85f8ab172108c8fb61e45f70c
SHA512 071ece6913f89a4b1634daa9d650bfa8f9f406719c124a3819cbdd3cb617af419abc6010283dbb510891e9744ce03cadcceea7b137395c538f42df838b1f6322
SSDEEP 96:5wwwwww6W/rQPIEXv6KvzVqzd4sJvbZwwl/j+jNj2jly9:NQrXvfzwzRu
TLSH
T1C4911623531D1CB9FD2405F1ACF89A75A59CBA0153C63C642DEEF80F69AE8C69AF2444
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwA.exe

Path C:\Windows\ecwA.exe
Size 2.4MB
SHA256 f9bab4890de0a90185c2374822f0be7e9a6d4fea5a2ccd821ab58bc64eadf9e2
MD5 308f924fc15da592a404b75a39dc14ba
SHA1 c3d68576fd0a075cd01b07e9dd5b0c8d34ec0e1a
SHA512 f2b5b7ea39577adba2f055e0ccf6bf789bad63ed278ffa8c3caa6e893a6dc3575daa6452deb7a92781873b1e577f210753e1a020f498081104f19c25fa09cc4f
SSDEEP 24576:B6RBgnTLjTTDjfn+cPwEOwmHtxY0+LQZjxcuRH9C8dSSaVaG93KkI7fJSckH:B+VcoEeNxYzQ1RH9C8d6su3+7fcx
TLSH
T170B51BB734219486AD98491B4B5E9A190F4E0B4FB4E616207B0B5F7F987F07BBE43138
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

egsK.exe

Path C:\Windows\egsK.exe
Size 2.4MB
SHA256 2585228cd5c78c108d140a345385b6e49f6486c208554b4df790cdc2dc778fc2
MD5 2faed85094e5ccce5f25279386972a22
SHA1 4aa31e847706c92d033d9c9336c0bdb023afe194
SHA512 5fd90fa5ae82e225fa401b6a8ffcc1af76bf57870ff06abd531feb56148207e4692f7e8d18e60274b7bae0c9517664671e3a50301f1c0cc3b5ad408adc265e93
SSDEEP 49152:W+vFpLFR1BWzVBWWtzwxaNO2COdYuLCu:dvHr7WZBWsnO2Xuu
TLSH
T1EBC54F8B32C589A84FBB37B2D6246EE430DEFA3858C15865930D0DE135568FEDB38539
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ekQc.exe

Path C:\Windows\ekQc.exe
Size 2.5MB
SHA256 f185d894e2613f234eec54c8d76300778c30def439341fec5423f4d394e48328
MD5 bb695e1e1cda130542bd1b73e91dce32
SHA1 c29f52322e5809a73fd1c371abe7e1f829752c70
SHA512 59308651d15ed3d7aa595f6fa083195b9763dcc805f38a9fee3ffa1f8b412b491d228db366e8277a15b1cfcc600314fe3a73671ff29b0d14dde34b8080f18128
SSDEEP 49152:jsP7pN4UojsE6eznQwduw2tQTSI29FlH:+7T4X4te7LyxFHH
TLSH
T169C55EB2483FE6149289B65C158771EA98A361E3F20F3106B5C74FE873F52C8B5AC15B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

esEk.exe

Path C:\Windows\esEk.exe
Size 2.3MB
SHA256 ce101af81a9b9e60eea9ad2e7fe95c954b88872ca13c3bfb75a214daea4b9297
MD5 50b94efe097d5fb137ae93062dd0a7e1
SHA1 32df001f4675554adcc033820706aeb658b82140
SHA512 17156859eeaf42857f7244f5a8c60a7fe31cdb43bbc031898a9f923aa712a15817339c0766ea0ee4e36b4712edab421502d9c9f42f3649f9c3be167092c094de
SSDEEP 24576:X+DCQFVBSrDnkwHCDUtmqhPvsRLA4tHsCitzsC0Ez23RSUp6:ECMSnkwiDU7psREmMCiVLUg
TLSH
T1E7B53F2748732192D014AEEED7C4DF5E1B3E50F8AF9EA32A048F14557115DABD03BA8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

esIA.exe

Path C:\Windows\esIA.exe
Size 2.0MB
SHA256 ec323fe34bba42fd7d38a82f7ab490e79caf491c5248334e9accb8e82be40026
MD5 2ab09140a2b09e4c59b4043a62fa78b4
SHA1 6557ff944a35b19aaca51aa4e96964ee42b69f38
SHA512 5643c5c3cc7958159b488930f228731d4071621afb13fe5ef89001d32221058178bbd55858e6fc595b0ffa018d4d1bd372b692f16e180cbb6bfd998ffd0a3111
SSDEEP 24576:52tHWoHRU/fGCawb66pEHLnv1k3hEl+xVaBTpaXLRsqoCI:52tHWoH2/+CJ6E2bv23ul+xYYX
TLSH
T11EA51E526BB43D2AB3D942C10C99D980689C05FB62297BE6C7C43F04EBEDE43F946752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gAEY.exe

Path C:\Windows\gAEY.exe
Size 2.0MB
SHA256 dea25f579c94b4d3958576e90fabdb2215c5257e21938f608446dc23c1019144
MD5 18119f5c5a118d37a9773d779e2ede6e
SHA1 7016855290137eb14658619c57351e0488181a5c
SHA512 8f64873324932406630b80f1b6dcc629b7b5ecd170704d42aa6d5c14984a502f1da0c8700e059cb29e2e026f0901d85816438d0ab09d5da177a36d77f1afee4e
SSDEEP 24576:IHIRCiWPKhdeNn1V4sN4zD3HXm5Dd8PJ7z71iKBGm3IKQZ/KdvTOtl6Hbl5:kIRCDShdAOfMDd8PJ7fQvZCbol67
TLSH
T11EA5D8BF4872C61AB23B31B195C64991583EDC57C061BDBECD2D3B203C51EE96E9B089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gEMi.exe

Path C:\Windows\gEMi.exe
Size 2.5MB
SHA256 4e1d5bb4fff224a1cf4930d82b8b1e4a316081a2a33059318ae98a8fe763e34d
MD5 5b91862d2a9150ca4a70f96c2272be07
SHA1 6353ccf3f3d5d03769e43a9871225a476685bf95
SHA512 02811fea276a3a6eec147642618484d8847ebdb5417b3262b406edab9f31fe63737f4a36a8e3bce0bfb743678e9efcffa4378b0c6d8bed87f7d1471b089add33
SSDEEP 49152:jPkgCgZ5+Gi+vagrocqFXKJY8s/8S2EaONQs:jPkgCA5Di+vlrhq5KbS8B9Oq
TLSH
T113C592436526D930ECA07CA263CB67B6A5D67A68660F02FC124D77BEDCD781F4CE0858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gcwY.exe

Path C:\Windows\gcwY.exe
Size 1.9MB
SHA256 fd5c7fdd14df3b5c14a4538c2b3088e777cc7fb053d3d593e13b03fdd8fa8dc1
MD5 51e7be211ba0a43513dd83593fc4130b
SHA1 dbbd57b71b00277bd21e0941f1cb9474c85b5466
SHA512 4619352e772689e3e31ef37f361afc1a4fbd0a73c59acdfa01efb97e771b16886e81f5ea4317be6f354a800d245d173597ff64fcf5e2d20e2f9454b9e4055478
SSDEEP 24576:0HwDFxoqYHLJvj+oV9V6MvatfcnnOaQcCmOmNT7:0HwDFxoqYHLJvKoV1ofcnIL+H
TLSH
T17C953FC6B71ADC07F8B4AFAA022017714F2821F9E652790DD053A754E7EBAD3FD9050A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gkAc.exe

Path C:\Windows\gkAc.exe
Size 1.6MB
SHA256 0feb1f83b73d12c78b9679a2c8595eb51c1c9ddaab39a37e3dae6367501ed3b1
MD5 0c9234e91ea4414e568b08b380f1f371
SHA1 f3f58f46701f73d62befcb9a2d876a178dc44b1c
SHA512 e1ac2db46637bcf4d49134da58dc60c6432db07ac0b9fc339776d16471215a353f746958aaa7a7915e04cda7eddb8bf056e09f3ce664c77a42f19573800b264c
SSDEEP 12288:b0zWd/VMtFdqqgp2R9KodOYqCyJ3SFySaStZa6CY2xvwejn:wzWdsFsqlKoMXJcyazCrIan
TLSH
T1F9750A21EA9F8B277220613D2F03947CA6E2D4CFBCDC4457013655B4AEFCA3DB6664A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gkME.exe

Path C:\Windows\gkME.exe
Size 3.1MB
SHA256 c2acf3c2e09cf5ebd87de4a5f95f26289cd474f1d790d759c694b98c4e7277e9
MD5 d77ac54ebb47f061a739a84acea4798e
SHA1 c8833717271f1cc8d2ac3dd5201707c8d2876397
SHA512 f5eb35134485c12782e7b6a2a820c1a09633c06f65453f057d9282e2c2afe6bb321c114b566e9cbdbb6f79dcbb4b5310364d8abffb26f0871a0c62e61810eb7b
SSDEEP 24576:WFlGmf34wES9kBxXxpDSjzI4KDgWisAZqv7AhU+wX4bqfJ2XZkfj163I:AlGg4wmxXxpefwifq8hU+wX4qJNR6
TLSH
T100E5837D714E3E668BEAE32B4324D0783D378D444D7BFF6AB1D0394409B528929B8798
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gwow.exe

Path C:\Windows\gwow.exe
Size 1.6MB
SHA256 70ec346e009399108fad8af5fb09aa1f7dfcb00051108a6fb916909e242f3055
MD5 0dde37c3f927b4a8b79a978469b7b927
SHA1 a42d526b8e520efbfefa05c004aca58284ca1f18
SHA512 3c873ceb92ab2d4d8b23c264efb805a607af42be7550dd33a10e45f8250007d7cb7d9791464d440750ce57109afdadcc7f72664e60b9d813259977ac05530575
SSDEEP 24576:j1qWypYPcJXMbCc6fYuRjGVDT7L5P2VziU1FzC:j1qWyWRh6fYuRg7Lp2TG
TLSH
T10575EA9FFEE4432DA69FF4AD5D929C52AEE6555101B8012354847A8C9BF0E3E32C07E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gwss.exe

Path C:\Windows\gwss.exe
Size 1.7MB
SHA256 19cb4e74131bab384097d948ae034910785f18d6de8d86634f5984f001dac7eb
MD5 18f77aaf610b93948b773834ba207a98
SHA1 1027cdf641f0ae80b7e06f890670f584d7e980fa
SHA512 5795803ea7973e805ab17c5219bd44daf5b4eca46acb62aca3984be519ddbada0dc272df809b780434a953ecb6665f3b6ba6839e6c44809a2d7567aed5915433
SSDEEP 24576:Of15Da4Lq0F4H9ME0/NGJWuRUVI3q3DI2KdW:eDaR0aH9M6r38I21
TLSH
T10E85FB8A0D15C8CF9911CDDD06CBFC80D6ECD8A5A4F64DB3D686E74697BE39820B6318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iAgO.exe

Path C:\Windows\iAgO.exe
Size 1.9MB
SHA256 f1da03d1cc79acead7e92d6b7c13d6ac3a11af88b03a5161cfb1311c091674c0
MD5 8b5069d88e7af52a3d9ab60d4015e248
SHA1 1c2f23dd2797f2b80672801c9e3c842fe9350801
SHA512 62ee0c340953a88df8acfab70bee98d65d710f24c27cec1f02f49595b9f045e3fefaee95f8576b909d238da125c36d507b050b8fa14623c669785000cb5f8653
SSDEEP 24576:iNI1enSFADUdmNPTzBj+eI1DAmDwmlSzzruH:piRj+18tc
TLSH
T1689502E1F2F796C76F476F6200280DCA0897C850A55CCCBAA554958F33AA9C787F5AF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iYQC.exe

Path C:\Windows\iYQC.exe
Size 1.8MB
SHA256 459b295457de8e9450cf6a73accdb741cfe571257d09556f4fa7a169430cf79f
MD5 f32be67386ad604d2b8b1f6ddf3b9863
SHA1 e55b8e5f4e1a33b94164b7f5042c8703eefe0af6
SHA512 0f14cd5f39a80354fac0b2c090611aa687ad0738b2915ead78cc62b0ace63a589938df384dcfb379efb9c9a45ec87a99782d900cafe4b0710b12773e2648fc6f
SSDEEP 24576:Eo9km+/pP5XolcNjZ65FdV3AI7N1wDueTi67I7uAMQa:VkmkpP5YlcN9m5VferI7H
TLSH
T1778563A39427F22C9069A027FD1FA197A9FB5D3FC626D7DFCFA185C59084433189022E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icok.exe

Path C:\Windows\icok.exe
Size 2.0MB
SHA256 16254562b7bd7f24bbf3685c332c56c248605267876f9476a02eb890e08b0e28
MD5 a8032f0e76ae2610ecf24b1809969ba8
SHA1 f43c5b8fdfa55e3ba32e488c666d6efcc75fd20f
SHA512 c9339a81953ac04516c269e074fcfd0b9a5ae58b94e77d56014357250ea68e7f458f2d7cb3b6edc887a699bbfc6118b4eeb14075ca32fb062d1ba2f489fab4f8
SSDEEP 24576:tK7AOknLrPzggZZHXX46RP5KgbPjU2IbtBfi:sSnLr7ggZZHXhoG
TLSH
T13EA5EC533427285886F2FACB4A1F4DDCC1F988D32BADEA40795B207A7C33A4515F89D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iswI.exe

Path C:\Windows\iswI.exe
Size 2.5MB
SHA256 5eac2bcb3a3a3041edcf274e15ad7763cc80766f6d58d8fd82e95d2135a7f184
MD5 a720396f9df101b6c2ae881fea40cf0e
SHA1 0fa301d439936eb4f0e789ae320af4fc48020736
SHA512 343b147bcd6ec82c990f51df4c5b6c91c580fed87e36b594d927baea44ed53e428e0966b935449d226e572705730d4e3692db3579d7a259077b36bdc99400e47
SSDEEP 49152:OEnyVfktAxf35ZG31sF4FhGCuVHCPWDW5Z05Hjj3OpO:OE/tAxfr0SSF4CPZ5Zwr
TLSH
T146C5A47C50F60B12297B5B4A1F8B71D7D63C0832B8C45B37888DA3D26C6ECAB48DD959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kEcm.exe

Path C:\Windows\kEcm.exe
Size 2.0MB
SHA256 699896c772fff2bc6922b4326235808a1fb2894ad3bac48a93f5572f84966fb0
MD5 ab497b5e23a1cf90eaf1f2468fc254b6
SHA1 c5730071286c391f6d53f87b42f20197db31e1c7
SHA512 f8ada902cec9ca3e043673907ef47c26dcc4ff2a19447daadd64b9253934fcf9ab74b4577110c08bf0ae7ca2f388df60c5ea3d7dfdc8187b1bed39b5d0e7a7ff
SSDEEP 24576:FJotK1tC7YSEBwb2nTkD/mtYBhDQ+edcsNxKeTvC2q0sxu:FJd6sSD9D/hDgxnTvC50f
TLSH
T1B1A5FBF2329EC34861334524829F2D0BEC6A871F270D43A97DD16979B62A5FC17F816B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kUIm.exe

Path C:\Windows\kUIm.exe
Size 1.8MB
SHA256 ee6ec33dfaac1893eb4531dd6edd8869ca32a4454737c29de58769f9ae34b5b0
MD5 8e1559910251a89bd4c2055adf3d1bb6
SHA1 7be9283cb2b4556a7c237580d03f97c9c5536952
SHA512 ba4bccc2b37626ab27da2569f1d45fb0dc3260d5fafe8e81346d4b3208675c5c06b4002e52485718d2363b3f8961d741fe72507c13b5e542bda265e7a51a7f7f
SSDEEP 24576:pxIo4qTNwdhocYSTv5/c9J1+VdZ9ZCXovFczbQsbBZJ:mqG4STv5/EkVdjZ3tOQsFZJ
TLSH
T11A85E27B47E4463BD0C5444B487CE92B4194A2E781DADB0237E3F1B72BEBC1E6C99624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksMG.exe

Path C:\Windows\ksMG.exe
Size 2.7MB
SHA256 e5c828cb106e99220a03cdad48df9be1702633cc4fe019ea0f78322e00ea92d1
MD5 1d0d5f499fa191a9a623465fcda133fd
SHA1 2b7cd7312f5a9ea818ab58d19e338e14af4a271b
SHA512 21ef79caf50bb827eedc8a58593b54db8cac43406697f2321086d9b09adfcff2ba082942f86e6b3d80cfd4a44d8a66cc9b641a6d081f7bfea0c1e38f4d3c8e03
SSDEEP 49152:r9MjowLdCTRPXoThZfcx+9CfmPFWvHfu56EsIrGUgo4My3HVcND:rOjo+o1opCfmYHfu535qJP3uND
TLSH
T1E5D5831D5AA24AC4B5C34817BBB6605861F0249CBACF2E3B5637E1256AD8FCFCCD18C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mAAq.exe

Path C:\Windows\mAAq.exe
Size 2.0MB
SHA256 8a8ebdfb7e04603ea6cbebad3ce488ac6e5bed132ac03e5a96e5ae1d5edb642b
MD5 91000602f1c7ddb9de861a94f70b8a58
SHA1 b990ae594f9ecce51d5decadf2e8336d435c72db
SHA512 9f543d72cc17f7b568de52c7cd8a128db791a2f56fd5ee1fa416996b48cf45944693b8ee81b45d173b6306aa52888d63ffb0daea6ae8c417f1468c5e9f52e3a8
SSDEEP 49152:cLktCXebL9d9poeR2ts+SV2XkwVI1aFy:2kYXebL9HpoeRsV0aIIFy
TLSH
T17AA53E8DBB21D0D129948476366E676AC10A79A364A0539ED3382D47FBCF8FFD64C1E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mMcs.exe

Path C:\Windows\mMcs.exe
Size 1.9MB
SHA256 525ee60dda96eae0b33d1d62452782242c529b87e2d62c7e9503e5e64a85798b
MD5 7d16f6e50e37d0013eb192f167ce8286
SHA1 d887aff67725232565141008fc5cf847b576e72a
SHA512 d7ba3f83cd0e409cf170d0edc0219dadb16b03d6695bf649eba2e8cb93aefd131d8f876c9dd232e13e315f8868ba139cf067210b17181dab573408652e833214
SSDEEP 49152:jgF41wzzbmVVvdURpAFprjOFW60f3eFPpbaJsRdakPiTHZjGHxA7l1x8vKrAOh1f:IQMgtYg
TLSH
T1569570EADC91CC7B60484C1F441BA34532DA7059215FF6213BA7EEFCA76940E96E2F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgUw.exe

Path C:\Windows\mgUw.exe
Size 1.6MB
SHA256 7a12a280faaa98329f7f9b10745eb27b8d15a608cc5ac9431f2a249436c0157c
MD5 c2236be610b9138f30c2f1cdf946cc51
SHA1 512547de7e4709bf6cb88d3a056734af3e8b19b3
SHA512 8a472a3bcc6c126dad7791919d97f1a8b33b5200bb0224656c33bc5b5b18fefa6c56c2f311ef2b2083b8888ef9d48b914b93b7761d6fa6043e060346f4789b7a
SSDEEP 12288:5B3PB08ivdQES/x/qiAvWodKbuQtePUFAahFg46vpVJLNJqwN/bV8T8jFkSwIhAQ:rmzSqiAuo+L4Ir0Zp7LNJqjsFk4JFeq
TLSH
T14775FCBF7992B18B566C84AE6CDC14E8E277085271219CF7225435B6CF4B237E908E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mogi.exe

Path C:\Windows\mogi.exe
Size 1.7MB
SHA256 13461628f6a3734fefc43a46f2ded5d010ac80e3d9066c80532bc1d3c9dbaa43
MD5 4b0c97272c4141a957311bf9099e6e77
SHA1 8da3ebb57c7eab034c02bdb17171ce93921778f8
SHA512 22dabcedb576c58e989443fd4a90c0cadb421c83440a3e980498261049d1edf90243a99032ed841fa75e72cad25b09df15eb17b83df2ff944bcd31211b4269a5
SSDEEP 12288:e2XtWSEBcmT6fMdFoDXEDWs80q9JJs9+wE0/uP75BSzfhH93bayMmZQ3O+uTuJHR:/GTUMdFcEDW90ss8wmPPeZMPO3T2x
TLSH
T18585EA6900E1C386AC5F79D5DC7027667F891B28F4E7A44E335D8AA2A15FC27236F24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oEYg.exe

Path C:\Windows\oEYg.exe
Size 2.0MB
SHA256 49e82a2a52c29426e660e82020595499e355acf9a4a31c3d8c0a009bea12acd7
MD5 e5bc760e42ed086bd7a1a8c7cb4dcb86
SHA1 224e24972bad0684496169ae79725f2fdfd65a10
SHA512 da2860aa651c24a5048bbcd4f069ee00f0cc3d9ae2637550f17673e15b38c524b8e1f3074cb444fa8e5c7619be48805a85debec0fa2e106f0505b00f1fc5cc54
SSDEEP 24576:nRJLo/aKg4eVvwZq44jieRhXR+4EYZlI4lpBXy9t+N:nfoSKUVv294jiSXR+4EYXI4lLXy+
TLSH
T131A55FA84289F7F58CF1BFC54B506E19F9EFE78E44E03823215625F1C1A8DC68961DCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oQUy.exe

Path C:\Windows\oQUy.exe
Size 2.2MB
SHA256 0e4bd1fd875f042109a4cbf8d0abeafd076eb436b315b5f322fbe446fd1d50e3
MD5 6bee6e9c31b293a97c0a67d4cf98e79e
SHA1 74dae12b9d4ac444fd6c1b8bc5847ff35027f8d4
SHA512 d5bf2c45868b03583f5b6c1cd50f6206011f3f067b30ad9313b19130f0ba3f926378c242359b1df6faf3f6eeef1b768ddd085c84c2185bea09dccfe14f0931de
SSDEEP 24576:Nr7DhkF8stNw2xHXzlUY/LOFfqLsJaWNsCj0AuA2nIbr:NHDhd6pxHXzlU+LONdJpGNQr
TLSH
T1DEB5A146FEC2510ED564ADBB506C9054F30E269D926E826FC7E27C3C0EE3DE564B7288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

okQq.exe

Path C:\Windows\okQq.exe
Size 1.6MB
SHA256 65411b6d827a834df4b4e4642e758b283df16dc4fd30d0970ceee3a910a70be3
MD5 a818b977b24b07011412a4da4c165cd1
SHA1 7a2f7e6d99233ce3d95e5231a48db90a95eddcc9
SHA512 c34cfa7b2b013324d3bf310a9c8bf44b76ab7208791b5cd80e800e6d55acd5c75912e435589377d15bb8fb642031c81c3aab7068dbf2889e1675fe606a4b58e2
SSDEEP 24576:5GMjH2xBucM0lYlQuWorjfrnMJA14MOI2Q7xjK3O1MY3ufwSrPgWRZZ87:1cBVMtg6SrP87
TLSH
T1AF7589A1050687CC96CD0D56681C49F3D4AF9E3B663278B83680EDDF8575B87B8E03DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

owIo.exe

Path C:\Windows\owIo.exe
Size 3.3MB
SHA256 d3b5e265dd9dbae538a5898364c72487468c554caa1a9998f0b1dd6218438c33
MD5 7a1bb2bc1a7066cef904038162c0aa99
SHA1 e5b63db5b8a270e8602e5fa6fbcd29939a9c559f
SHA512 50d09c9133d62acfaa97ca095b366030f2fc8906ecbb50d468f24cbc3d2fb79315a61406cf6223c6639af521b196c719b0838f44ed59bc5fdf59bbaeff878d9b
SSDEEP 49152:TGVdZlVyR8M11byNgkKcxxqgdqI5qGr8OkSgVEAsvhr:TElqQgk5Wi8tSM1svhr
TLSH
T1CAF5085D54B11A2E1C98F0F2F958AC9EFE4C5B7D102C2873072B6366A01D67A4FC4E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qEoy.exe

Path C:\Windows\qEoy.exe
Size 1.6MB
SHA256 356e5ad8d3a5e63b4805a97abd9ee55d929b31b5d0b1bf6d46016995a2e08021
MD5 c8f24598968e54a09399636e3317d1d1
SHA1 bfb3195e87abaee673583a710ab87fb56d981752
SHA512 0f11ae2cc8186d9349324d70c801c4c0c2cdb46484bc13517b2900efc7c3d9be004ddc1d1f7d0901a1b76eec41fed6da387a06f1d2751e2adac755d494f2cd6d
SSDEEP 12288:BiPpl9/g3EDur/U8ZzEmRVcojnRsjfQLKWy7jwLaHOACXYuysOgb:BiPXhmrM8nRVhRwILKnELphXZGg
TLSH
T1F275ED7DF1DC9A4EEE433818419957B63B1017A512FA286B3B96CB1E3C3704B79AD087
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qIYE.exe

Path C:\Windows\qIYE.exe
Size 2.6MB
SHA256 c7cb28d7f3d42596ed5f45a9b4576e4573ce838da70a6c55fc8205edc793e1e2
MD5 87f183643831374864afd0872298e21e
SHA1 86200d30de4808c8674ebe3ed83ec0ab6392f5ec
SHA512 377d436bd889bb9c9231fd681fc68af8b86487adabdd5c6cc629b1fc67faa34d9c4fa4bb9f61b4895b6621c8bf5a4cf753af2e933a5ed1f85c31f97729f4376d
SSDEEP 49152:L4RkcOsIMhLpGjAuqhM1kV/1ph+ha/XA7Sd:LSkbudGjAlMKXM
TLSH
T1D7D5B42485552E94D1FCE2EA4BDB9BB5E51C2C5EF24178CFE6E1C2640124CBE7A3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qIwO.exe

Path C:\Windows\qIwO.exe
Size 1.6MB
SHA256 fcbb01535e105a8f91a2658e7e0670245b61231e9e9169790576412a9c44ee4c
MD5 d23bc52b176913993c063cca1c0041d7
SHA1 abea4dad17bfc935a24bded39bad0ca7868fa4b9
SHA512 8529a5e736bf5e41742f03441fdf37c86c6bd6b2fc6cdeae078586f90ddd2d9238df658eb7f4aad00862445098403d0efdb3fe98833cd3c4c1669b7d15d050e2
SSDEEP 12288:SWutiwFS+5tXksYIol+f7Z8rVIiodiFB+9tlRY1J8R4gcjW5QR/QbH:ZutFvCQfdLRd+B+9tk1hjWu
TLSH
T1E5759DADE20CFE673DBAE10BEDDC997F151DE5A72AB6C5A8CF5C8E03453C4480882159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qMke.exe

Path C:\Windows\qMke.exe
Size 2.0MB
SHA256 4f02071d99fae1bc13dcf813053447523f829e60314664a99198b3072e6371a1
MD5 5f764e41c726b585948c968f92d4fe0b
SHA1 248ba3a503fffe0ed977e7ce1b35e35c123dac60
SHA512 a608f1a0a6a8599db1e6a8bd6ccccb6f4b95a314f67e8c0973feeb0855f55dcd723bdf31ace7b31e734f1e176877764419ee3b47adb95c0c295d8673201ff787
SSDEEP 24576:qi0aVavYGhRbdG3eCCVWs5jkuvIeAq38fMT:qFCajhZAesUIuvK
TLSH
T136A530B1024ED9F406352CFCEFF49353477B16942AA52BF83D1B2685A5E21C2778E60E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qcso.exe

Path C:\Windows\qcso.exe
Size 1.8MB
SHA256 8268e6f1c02675635bf0596520342e6ec55f5d353926f73130bff5f3a115aa8a
MD5 7bd27803c4ca9a0bdf4006090147bdcd
SHA1 c217f300e14471453c2c644904e82e94e58e49b1
SHA512 22c5a751e290a7161065d4e46e5bc75c4ab17ecf303a0f7a01a302cffcba914715615215ed8177aa8bbf51c1fed146285b8ebceb64acc62c346825aea09f1ac1
SSDEEP 49152:iSSSSSSSSSSSSSSSSSSSSzHa9WozRUCoOidBT6i:iSSSSSSSSSSSSSSSSSSSSDSDRUCbif6i
TLSH
T11995FA2B04FD5FD2BC021B8A7BF82389D18DC625528D4B7F7738786AF19A93C0D96614
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsIG.exe

Path C:\Windows\qsIG.exe
Size 2.3MB
SHA256 d0d3df7fcf976fb6ab1e4a64bc58c1c24ac621c5f2a902caa78f56b9fd92378a
MD5 59d5001b7ae097cf7881742ae42956a0
SHA1 b82d24a8b2fe1cce2e70fd248017ef7354285264
SHA512 5d0c80c745e2f727208802eb6617665c5adb3321ad994c249d2e35ae8d8846d6df7db39d75f88bb8b980889d8bf181aad406a8121c1fa776766fe2fe5e02dcfa
SSDEEP 24576:AYcY0ZnKdapagYQfxtKLFv3WXtflK+wBsHkK7cGpVksDNqRmnrlwcb/D:WjZsap+QzK13WhS6H57d0sDN1XbL
TLSH
T1DDB593773A15733DAFE4CF44EC02A2A6A7635F1A848CD242E5787B2A13B11579B48F43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sMcy.exe

Path C:\Windows\sMcy.exe
Size 1.7MB
SHA256 1d659f792f5aa5eb6b77433e77b5080488c9cd6f5887bb8a1920e791ed1d8338
MD5 72eca142323f4c5fb9eab518ef0c06d3
SHA1 c72785b5ec5064a5a3258d1a78556f63a3c00107
SHA512 ab73acd00abbe51fcdc9ccf40d4463038dfc733ae8d9b0e9c661728563e7d3339e3375ce1c13531ec497740af8787862142b6fb3ead6a3b2c2943f3c0f2eb28f
SSDEEP 24576:fwdtgki3drIWI4gtc1ryraj6AcTKyyrpHAGimuoua4r:t3dMWF2rZeZxua4r
TLSH
T1CE851A3CF51318EE8C02B0101E55A0C83BEB8AD1D36DF81CFC54D595E297A98AB7D6B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sgIc.exe

Path C:\Windows\sgIc.exe
Size 3.3MB
SHA256 c8083b86732ec49bfd6a2f5c980c993bc5fdd1b0cb0159a1fba3edac066b18a0
MD5 3196501670e5d1250011ce676ba0e963
SHA1 939041c2b399f9196daa0f00cb3551f26bb41bb4
SHA512 1180e2072cf373224f0b45bb86af7624ec7e8ae82cee04c5481bcb0cbad21188d56772d8aab4401bb30eea26a1b0f82968de4cf123289ba259d6125cba6a12ee
SSDEEP 98304:4Lqcl18Boq6NKjk4w4hAA+4OslMTg+WRYz2IX:42c0BVckkL4lcuMTys
TLSH
T188F5914A846FEC095BE07A53B29394FB552E9301DAD794B7A34CA411D027DF9F8CAE30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skou.exe

Path C:\Windows\skou.exe
Size 2.2MB
SHA256 8377ecc64885306f0e29dce69fb178b604d36c82a99353175751f3b242c3a56a
MD5 ebb189cc1b61dcfe3f70261f7ff71fc7
SHA1 55eec771e3f9d63d82a697c3384b0af416d75793
SHA512 e56c237c5fae804139eb8ae88965cb6df475d160766a92dbb96f9ea3c1e27e3e71004b0ccf103a302c7229793551b924e65ab5d0a2f219f9552706cd8dde81e4
SSDEEP 24576:65ewgmr4YqX8dDFKV5TPSMipngzi6eQP9dVuZ81L6o6fj2WQiBFyGzN6fOpPDP8c:65E1SUkpngzi6dRRi37z8fOpPb8c
TLSH
T1B0A54F4439EDD3760D81249C21A8708045A6A6EDB997D32BBB4B1D7DF382F0FE212D76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uIIu.exe

Path C:\Windows\uIIu.exe
Size 1.7MB
SHA256 6dff76d5f583534e9a7d5e801449d667423fce5dab9dafebb8ea9331d25fd5d5
MD5 44da8e3b928be0c0517324f796c91afd
SHA1 7d245036d38e513905a1c714d6f252169eef5d13
SHA512 2c459a17fda1da17aef991c05f4c9571d682c19e014bdad55efe0767fae1f1494496204450f28475398b701e97fb16682969f83ae36d353f0dee70e2d370e277
SSDEEP 24576:KdxrIrgrgDOPCHYnuCfFAVDf5kOe6I4aK3V:KdlI0rjPCOrFmhh7RV
TLSH
T11285EA818095E4E9D89BDA0AB167D12550ECBCD82CACC1F6C7FD2246F0DB75B41878BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uYcy.exe

Path C:\Windows\uYcy.exe
Size 1.6MB
SHA256 c52dba0367d96dd195335a233e84831af587e120582070d87768d430fe073e4b
MD5 91ecf40161f1011ae6afaafd2b5ff783
SHA1 5352bbcc0f7fbfd795c175933aeeee2cc1abe5b0
SHA512 2a35478430de3e31e7addefe54c95be8ce933d7583c8cadc2563ff5dbf1d80caa825b0b89e1c03861ca0f8506ee92f85cf4fb80516cc241f906a142e51d05627
SSDEEP 24576:CSvykwLy/pZhzdAZjmH2MrOdnESMyigXK:C1kwLy/fdsyprOdnESMyn
TLSH
T1B875532A34B34574FC35E21F27BE917FA685B36F6AC191E505AFE40C67088450B892BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uYoc.exe

Path C:\Windows\uYoc.exe
Size 1.8MB
SHA256 12901df9d31772b3b6bb5a0d6d4fdd0a737b3bf521de1b532cece359c24eda6a
MD5 92b5f85952cbd406de8511971f24c66e
SHA1 5d9927565d85aba71b1a8fd4f76ed2157658b04a
SHA512 2fe2b4a0753b81581bac2b25f6a497c1701463889afb9b01ca9ce1ecdf394030dc69f57615043e5714cf8b28477dc6bc4d3522ad43a0c47980fef21ef7899bba
SSDEEP 49152:8qIN+WikBU6fGtwHuBIkOtXCKRCmAQZu:xIN+u4wHuBIJtX1RUYu
TLSH
T1BF95FD94B541AB396E2D0AEC1BE33F995F19374F3B5A04FD521019FBE2DB582642B803
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucou.exe

Path C:\Windows\ucou.exe
Size 3.1MB
SHA256 4fe256a5c3c1dc4f6d91cf7dd34d9e51423db0b5ad9ecab5b8ee28734f2f50b4
MD5 d57b136f4504a12e82db43ddb2e086a9
SHA1 493171087b96d636c5273f6a9e9bc00284fa5fbb
SHA512 18674a591c33920d9f329e7ef1b8f2283d7387112602cabee64c393923612ade18c4752ae35c0a646130b301577c2d7f05ac1073e5347756c45000a86bb7c721
SSDEEP 49152:muFoh37Fh+5mmEplyeywGEUfqcksv5CqDK5IFrW4UCe6R:wLFhyEpp0EBcLNDZCa
TLSH
T131E5F845B0B9C79A8AD62C4DCFE305E0242FF9A0B5D27EE164D8C51CAD71896A71E0CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ugUM.exe

Path C:\Windows\ugUM.exe
Size 2.2MB
SHA256 9e03e4eb3d83d383a4ab4cfaf33e08f97bad8c73cdd6d7dbed060200012ad913
MD5 172d3538ac3278c66752fab9f8017b8a
SHA1 2fdb6eea4f6221426ef57f56828c1c7555da5ba8
SHA512 2caa0d0ff445d9282a81b333504bc9e8474300841a04bc9af6ebd9f22f6845080678f1201135f97bf696ecdae429e44c5cb545748afd8ca2bd74f2bab3444df7
SSDEEP 49152:ib5xXIIjdg0WhssBdy6niaz1qyCyxkVL8iVlH:ib5xXIIjdg0WiUdy6iQcqyd8iVlH
TLSH
T154B51C1E6476759D20B0736E81A8E7BED3ECC8522E3F6349E10B7A2156211F0B07DE76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ugca.exe

Path C:\Windows\ugca.exe
Size 1.7MB
SHA256 10bbbeec788233235b73ec23647bf44f465c46d1f7c1f3e75fdcfa075659fe59
MD5 103587174242d77256bb8aabf3084fea
SHA1 cfe09f2fa6137417ed03b2f8700e09d632df3718
SHA512 436066072922ce96dfdf02da92dd372d626904a767ca10bf37b286743fbe1978a5cfd97ed05c045c2f15017facff61a60cb60efb05c8e497e00fe04f4846e132
SSDEEP 24576:acFrS9Xj/vXG+tTS7f5SOk4CBjVcqDm/y9HCPMw3:xAZuwS9SECBjVcqDmqIMw
TLSH
T14685B875796C93671F1FDEB9E068C1B7EB31F57606A2E0A1D91FF5908ADC83B042900A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ukIu.exe

Path C:\Windows\ukIu.exe
Size 3.0MB
SHA256 e00feefff10eca60eac43751f3ef194876e7117c13adaffd06655e404ae22532
MD5 322b41b6516cb81c51f43a38170ed6d3
SHA1 551fd4a49758773ad83f7ffe9f6b6667fbd087dd
SHA512 a722e7fea31a03e555daab6f15bbd6ecf704c1224630a60954ad75f745f17a3ea5e5fcca6ac7496a79ee5cc8badfa9ef13999c49671e822b577d5473fc9c3d6a
SSDEEP 49152:NWCdJJTNBgk9apWvqpFlvUO/tax9D0QC1Ypuc1sgeVrM:NldTTYpn3cpeV
TLSH
T1B9E5E6CBE46419248B42C6F9CA4332FB458749278A56DAFF0C6344AB11F6F22ED27D35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ukUm.exe

Path C:\Windows\ukUm.exe
Size 2.6MB
SHA256 b52da829a64b43df4820dd714195762c9e627d0cac61800545ad94efdba64fd5
MD5 16459ede40a649bca89e11fdeacff7d3
SHA1 090c787373dce92aa573747ca35bf55af7e31dca
SHA512 72caa8bdc14635e6f6d793e8aec7f2a65ec8a83cdcf4d2ce297e92c84e28d8e92c97b90b89314c5e0b3dabae754aafc2de163db4e86d21f31e1d08477d4a35ed
SSDEEP 49152:VADhLJ0YZ/7PLnEir4Nn60ulA10WKF0mM:VADhLJVPLnFMZdulAKW0
TLSH
T191D5A48F27BD65B05C19C9D3D06A16EE53137D008F0E4DAAFBB96C778C45ED46208CAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uwAQ.exe

Path C:\Windows\uwAQ.exe
Size 1.6MB
SHA256 0f14b3a1837c7104682affd4d64ccbac7010004944dbf8bb2d7f4fb151135c8b
MD5 a94d6680b8b4d35bce60140ade890d9f
SHA1 fc4b1e7329b84ca06c5cd28b29a575aac5dc3b30
SHA512 cdcd5ccd82cd6fc50820a6911887824d67703cca240b6f6df3f4538eb18fd3499ce31381fb9156c59dd152cb0494ae3ae83db452a0487a8518204b4879c94d4f
SSDEEP 49152:ha3oCH0v7tHU6ixI8A+db97chQZRlGlgY4KBRxPrDtddK5ngkm1FPRW1LcQr234f:i0v7tHU6ixI8A+db97chQZRlGlgY4KBM
TLSH
T114757CE56F6CE8D6A5E0A8F4EAEEC34D4862C55574E12AF84823D110BC7F17C805B3E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wUkc.ico

Path C:\Windows\wUkc.ico
Size 4KB
SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
MD5 ac4b56cc5c5e71c3bb226181418fd891
SHA1 e62149df7a7d31a7777cae68822e4d0eaba2199d
SHA512 a8136ef9245c8a03a155d831ed9b9d5b126f160cdf3da3214850305d726d5d511145e0c83b817ca1ac7b10abccb47729624867d48fede0c46da06f4ac50cf998
SSDEEP 24:su1Flj/XygwYAaMiM1E2/pkQ14btLH3RJigg1Kjq:vFlj/XygFA28BRkI4btLHhJigg1Kjq
TLSH
T1579127351B08C4E4EC5AA53182A706F708AD2CC3D1B4D47B52F07D7EAF33B72691166A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wswk.exe

Path C:\Windows\wswk.exe
Size 1.7MB
SHA256 1ab47b79eb6dd97c8efe1aba811fe139922ba9bf601a90625776d7e98b2dcf66
MD5 1223c3f407891cd2668bb835118dc0a0
SHA1 4eb6626f5e3462a42e63e8a0ff54570c7e5c6801
SHA512 d75851fbf186b6c988f1836cbc56050c660565801438419ae9dcb98d08e04a5b04ff4192a9cfb6ad4bee0dca33c0595be0fa625d9c14b44a6d9be58e2c8c09c9
SSDEEP 24576:KLROfar7n8u4JU6evDcRZZp42YpRY23A7eRDfmAc:ORZQfJU6evDcRZZpv2O
TLSH
T19585B9F1B8DC88C0A5B715D0E86CC9189AC21B7292C29A0193DEC6FF54F98D5CDDF929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwIC.exe

Path C:\Windows\wwIC.exe
Size 1.6MB
SHA256 5ba4d29eec719838e1bddbfb755fd4e08224262938ddf44178080b9b2798151c
MD5 863895138583d4486b4e55dff61eb555
SHA1 2ccb02f287ab0f2a201de972b9b46a8db50417cb
SHA512 6cf31496e7b74f90fd6256a35445d498e754d365de9dc5eb664438cb0c9a2cee0f62332be701d6b272de3fb25bcb138d2ec13f96410f589ca8337994d57a14c0
SSDEEP 12288:+jcM1KAr11hNnQYzy4h1mQGdnaEt5zQ63OyA0tY8bGOXMklkwrxV0:+jbP1LNBDFGdaEQiC0Zt8kLrk
TLSH
T1747510E435FD2CF28A482D8EC8DC5B959FF8DA49EB2D0609181E475E1B86DCDF436602
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwka.exe

Path C:\Windows\wwka.exe
Size 2.4MB
SHA256 308f191835aaec632af0f544d97d48d1cd26e272d5d9c51f72de6a3463b06c67
MD5 c706b3e46e83a3b65f5e62851c5c92d1
SHA1 3de41d64ee02552a75a816d63404bd946e2ec53c
SHA512 5f964ce3311c152d606fd55bebfd3d0ce261631e41d70afeb06695162be92722bc65e9862fa039f05483f8d3cf90162a6eb105611a389a46b8e1689ac92b7ef7
SSDEEP 24576:PRWA9Fb19A0lVjTus1r1W4aDX8JkI8sdQbdNFCrcI06IC8Y7I/vz+wwRsWcAqsoe:PRDlCKr18DXjNAbBIcovz+wwCsm4/
TLSH
T1D6C541C48D23F6EA79FBEA7B32114798982DBB27592F5618EBF5EB34030DD82444494C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/472-2091-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/688-108-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/1592-166-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/1812-76-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/1988-2096-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/2116-235-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/2436-244-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/2656-224-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/2696-137-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/2732-179-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/2936-42-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/3172-300-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/3172-287-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/3212-286-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/4128-2078-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/4128-19-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/4248-210-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/4304-65-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/4768-29-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/4768-0-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/4768-30-0x0000000000BE0000-0x0000000000C00000-memory.dmp

Download

memory/4768-1-0x0000000000BE0000-0x0000000000C00000-memory.dmp

Download

memory/4852-256-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/4908-299-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/4908-353-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/4944-275-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/4956-121-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/5272-16-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/5272-2073-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/5656-8-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/5656-2068-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/5680-198-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/5816-266-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/5832-153-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/6140-93-0x0000000000400000-0x000000000059C000-memory.dmp

Download