nabucur | 3fa42133425e391fc9bc93af7490af2a32a7bbb3564378f9630a7366445ee912

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
Size 1.7MB
Sample260809-chfs5sgj61
SHA256 3fa42133425e391fc9bc93af7490af2a32a7bbb3564378f9630a7366445ee912
MD5 a38776eab70c54fc8297178f3817b110
SHA1 03121d188062adc4d80d6372ec046a4d26d9e050
SHA512 d42e98a007e9d3a716bc51fea8568fea9edff94e3ba564ba6b391e5e8d4a0f48ea69ed8bd591df486d98e58abdda0d15da62adb833ccef80da19ca649024f963
SSDEEP 24576:/VbBJyJi7xw+G79jCaoVgFbuedmIMSlqd9kaInb:dbBJyJi7xw+G79jCaggFtMSuuaIn
TLSH
T18385CE29E4C4CC50490CF47725BB9FD024E872E9C3C986342BE57AE1276EBB355B8993
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution nabucur persistence ransomware spyware stealer trojan

Malware Config

Signatures

Family: Nabucur
Nabucur is a ransomware first seen in 2015.
ransomware nabucur

Modifies visibility of file extensions in Explorer 2 TTPs 23 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe

UAC bypass 3 TTPs 23 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Renames multiple (115) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 5 IoCs

pid	Process
4524	ScUAcsIw.exe
4772	WWAQoEEw.exe
4120	zkIwIkAM.exe
2880	WWAQoEEw.exe
4136	ScUAcsIw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\ScUAcsIw.exe = "C:\\Users\\Admin\\dYgoEcwo\\ScUAcsIw.exe"	ScUAcsIw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WWAQoEEw.exe = "C:\\ProgramData\\lMsMsAcQ\\WWAQoEEw.exe"	WWAQoEEw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WWAQoEEw.exe = "C:\\ProgramData\\lMsMsAcQ\\WWAQoEEw.exe"	zkIwIkAM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WWAQoEEw.exe = "C:\\ProgramData\\lMsMsAcQ\\WWAQoEEw.exe"	WWAQoEEw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\ScUAcsIw.exe = "C:\\Users\\Admin\\dYgoEcwo\\ScUAcsIw.exe"	ScUAcsIw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\ScUAcsIw.exe = "C:\\Users\\Admin\\dYgoEcwo\\ScUAcsIw.exe"	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WWAQoEEw.exe = "C:\\ProgramData\\lMsMsAcQ\\WWAQoEEw.exe"	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\dYgoEcwo	zkIwIkAM.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\dYgoEcwo\ScUAcsIw	zkIwIkAM.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 23 IoCs

execution

Visual Basic

T1059.005

pid	Process
3928	cscript.exe
4476	cscript.exe
8	cscript.exe
264	cscript.exe
1868	cscript.exe
3152	cscript.exe
964	cscript.exe
3432	cscript.exe
3292	cscript.exe
1384	cscript.exe
3320	cscript.exe
1776	cscript.exe
5824	cscript.exe
1500	cscript.exe
4912	cscript.exe
3604	cscript.exe
2772	cscript.exe
1808	cscript.exe
1864	cscript.exe
2924	cscript.exe
3672	cscript.exe
5484	cscript.exe
5764	cscript.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\MIgg.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\UQUA.ico	ScUAcsIw.exe
File opened for modification	C:\Windows\YEkM.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\USYc.ico	ScUAcsIw.exe
File opened for modification	C:\Windows\ewQY.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\GMgU.ico	ScUAcsIw.exe
File opened for modification	C:\Windows\IIEm.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\kOoA.ico	ScUAcsIw.exe
File opened for modification	C:\Windows\wUUs.ico	ScUAcsIw.exe
File opened for modification	C:\Windows\Aigw.ico	ScUAcsIw.exe
File created	C:\Windows\mUcY.exe	ScUAcsIw.exe
File created	C:\Windows\sEoC.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\MkME.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\GYcm.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\MYcU.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\AgQo.exe	ScUAcsIw.exe
File created	C:\Windows\MkME.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\QeoQ.ico	ScUAcsIw.exe
File opened for modification	C:\Windows\kmwE.ico	ScUAcsIw.exe
File created	C:\Windows\gEcw.exe	ScUAcsIw.exe
File created	C:\Windows\iIUQ.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\qwoC.exe	ScUAcsIw.exe
File created	C:\Windows\AoMA.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\OyMM.ico	ScUAcsIw.exe
File opened for modification	C:\Windows\WWUE.ico	ScUAcsIw.exe
File opened for modification	C:\Windows\kMwU.exe	ScUAcsIw.exe
File created	C:\Windows\owAq.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\MGQk.ico	ScUAcsIw.exe
File opened for modification	C:\Windows\cekg.ico	ScUAcsIw.exe
File created	C:\Windows\Acgi.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\eMAU.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\soAm.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\EosG.exe	ScUAcsIw.exe
File created	C:\Windows\gsgo.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\mYkK.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\koMc.ico	ScUAcsIw.exe
File opened for modification	C:\Windows\OQok.ico	ScUAcsIw.exe
File opened for modification	C:\Windows\mUcY.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\AsgA.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\UyYU.ico	ScUAcsIw.exe
File created	C:\Windows\IMIE.exe	ScUAcsIw.exe
File created	C:\Windows\eYIe.exe	ScUAcsIw.exe
File created	C:\Windows\yUcq.exe	ScUAcsIw.exe
File created	C:\Windows\agUG.exe	ScUAcsIw.exe
File created	C:\Windows\gAAe.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\YUAO.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\SSIg.ico	ScUAcsIw.exe
File opened for modification	C:\Windows\KUEA.ico	ScUAcsIw.exe
File created	C:\Windows\scIC.exe	ScUAcsIw.exe
File created	C:\Windows\uwga.exe	ScUAcsIw.exe
File created	C:\Windows\cwsC.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\mMwM.ico	ScUAcsIw.exe
File created	C:\Windows\eEok.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\oegw.ico	ScUAcsIw.exe
File opened for modification	C:\Windows\ecca.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\GIMc.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\YYEc.ico	ScUAcsIw.exe
File opened for modification	C:\Windows\AYQQ.exe	ScUAcsIw.exe
File created	C:\Windows\kIks.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\ckAq.exe	ScUAcsIw.exe
File created	C:\Windows\mYkK.exe	ScUAcsIw.exe
File opened for modification	C:\Windows\umwI.ico	ScUAcsIw.exe
File opened for modification	C:\Windows\aAIc.ico	ScUAcsIw.exe
File created	C:\Windows\mEUi.exe	ScUAcsIw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 46 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3664	cmd.exe
2780	cmd.exe
4336	cmd.exe
5240	cmd.exe
5600	cmd.exe
3188	cmd.exe
124	cmd.exe
4276	cmd.exe
5964	cmd.exe
2660	cmd.exe
2392	cmd.exe
2928	cmd.exe
3060	cmd.exe
5944	cmd.exe
5988	cmd.exe
2836	cmd.exe
3276	cmd.exe
4636	cmd.exe
3100	cmd.exe
3788	cmd.exe
3904	cmd.exe
5568	cmd.exe
244	cmd.exe
2492	cmd.exe
5232	cmd.exe
3480	cmd.exe
1316	cmd.exe
5168	cmd.exe
4640	cmd.exe
1016	cmd.exe
2060	cmd.exe
4844	cmd.exe
3324	cmd.exe
1996	cmd.exe
3888	cmd.exe
2372	cmd.exe
5652	cmd.exe
4484	cmd.exe
6068	cmd.exe
5012	cmd.exe
2100	cmd.exe
6076	cmd.exe
4564	cmd.exe
4428	cmd.exe
2744	cmd.exe
5080	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScUAcsIw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
4400	reg.exe
5844	reg.exe
4212	reg.exe
3612	reg.exe
4404	reg.exe
5140	reg.exe
1848	reg.exe
4432	reg.exe
4920	reg.exe
6124	reg.exe
4320	reg.exe
2808	reg.exe
4912	reg.exe
416	reg.exe
3560	reg.exe
1060	reg.exe
2280	reg.exe
6112	reg.exe
6124	reg.exe
6112	reg.exe
2312	reg.exe
2360	reg.exe
1028	reg.exe
4708	reg.exe
1164	reg.exe
4916	reg.exe
5616	reg.exe
1836	reg.exe
3640	reg.exe
4824	reg.exe
2544	reg.exe
1540	reg.exe
3408	reg.exe
4496	reg.exe
5560	reg.exe
1760	reg.exe
5568	reg.exe
4600	reg.exe
5708	reg.exe
4296	reg.exe
2248	reg.exe
2972	reg.exe
4172	reg.exe
3436	reg.exe
776	reg.exe
4504	reg.exe
3432	reg.exe
1616	reg.exe
1188	reg.exe
4424	reg.exe
1184	reg.exe
3684	reg.exe
5132	reg.exe
1920	reg.exe
3492	reg.exe
2204	reg.exe
4724	reg.exe
5792	reg.exe
3964	reg.exe
5704	reg.exe
5476	reg.exe
6128	reg.exe
5108	reg.exe
2168	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1812	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
1812	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
1812	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
1812	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
3648	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
3648	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
3648	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
3648	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
4376	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
4376	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
4376	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
4376	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
4076	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
4076	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
4076	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
4076	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
4948	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
4948	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
4948	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
4948	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
1952	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
1952	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
1952	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
1952	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
4804	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
4804	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
4804	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
4804	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
2252	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
2252	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
2252	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
2252	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
3076	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
3076	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
3076	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
3076	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
308	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
308	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
308	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
308	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
3500	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
3500	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
3500	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
3500	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
4364	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
4364	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
4364	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
4364	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
5916	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
5916	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
5916	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
5916	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
5524	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
5524	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
5524	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
5524	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
4824	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
4824	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
4824	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
4824	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
3572	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
3572	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
3572	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
3572	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
4136	ScUAcsIw.exe
4136	ScUAcsIw.exe
4136	ScUAcsIw.exe
4136	ScUAcsIw.exe
4136	ScUAcsIw.exe
4136	ScUAcsIw.exe
4136	ScUAcsIw.exe
4136	ScUAcsIw.exe
4136	ScUAcsIw.exe
4136	ScUAcsIw.exe
4136	ScUAcsIw.exe
4136	ScUAcsIw.exe
4136	ScUAcsIw.exe
4136	ScUAcsIw.exe
4136	ScUAcsIw.exe
4136	ScUAcsIw.exe
4136	ScUAcsIw.exe
4136	ScUAcsIw.exe
4136	ScUAcsIw.exe
4136	ScUAcsIw.exe
4136	ScUAcsIw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 4524	1812	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	89
PID 1812 wrote to memory of 4772	1812	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	90
PID 1812 wrote to memory of 2744	1812	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	96
PID 2744 wrote to memory of 3648	2744	cmd.exe	98
PID 1812 wrote to memory of 732	1812	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	99
PID 1812 wrote to memory of 2544	1812	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	100
PID 1812 wrote to memory of 4824	1812	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	254
PID 1812 wrote to memory of 3276	1812	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	102
PID 3648 wrote to memory of 244	3648	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	107
PID 3648 wrote to memory of 2204	3648	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	109
PID 3648 wrote to memory of 5704	3648	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	190
PID 3648 wrote to memory of 4432	3648	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	111
PID 3648 wrote to memory of 4636	3648	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	112
PID 3276 wrote to memory of 964	3276	cmd.exe	345
PID 244 wrote to memory of 4376	244	cmd.exe	118
PID 4636 wrote to memory of 3320	4636	cmd.exe	119
PID 4376 wrote to memory of 5080	4376	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	120
PID 5080 wrote to memory of 4076	5080	cmd.exe	122
PID 4376 wrote to memory of 1164	4376	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	123
PID 4376 wrote to memory of 1540	4376	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	124
PID 4376 wrote to memory of 4172	4376	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	125
PID 4376 wrote to memory of 6068	4376	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	126
PID 4076 wrote to memory of 3480	4076	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	131
PID 6068 wrote to memory of 1864	6068	cmd.exe	133
PID 4076 wrote to memory of 1188	4076	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	134
PID 4076 wrote to memory of 4212	4076	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	135
PID 4076 wrote to memory of 3436	4076	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	136
PID 4076 wrote to memory of 5012	4076	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	137
PID 3480 wrote to memory of 4948	3480	cmd.exe	142
PID 5012 wrote to memory of 3928	5012	cmd.exe	143
PID 4948 wrote to memory of 2060	4948	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	144
PID 2060 wrote to memory of 1952	2060	cmd.exe	146
PID 4948 wrote to memory of 2168	4948	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	147
PID 4948 wrote to memory of 5844	4948	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	354
PID 4948 wrote to memory of 4724	4948	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	356
PID 4948 wrote to memory of 4336	4948	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	150
PID 4336 wrote to memory of 4476	4336	cmd.exe	155
PID 1952 wrote to memory of 3100	1952	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	156
PID 3100 wrote to memory of 4804	3100	cmd.exe	158
PID 1952 wrote to memory of 776	1952	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	159
PID 1952 wrote to memory of 3408	1952	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	160
PID 1952 wrote to memory of 5792	1952	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	336
PID 1952 wrote to memory of 5964	1952	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	162
PID 5964 wrote to memory of 8	5964	cmd.exe	167
PID 4804 wrote to memory of 5240	4804	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	168
PID 5240 wrote to memory of 2252	5240	cmd.exe	170
PID 4804 wrote to memory of 4320	4804	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	171
PID 4804 wrote to memory of 4920	4804	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	172
PID 4804 wrote to memory of 4916	4804	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	173
PID 4804 wrote to memory of 4484	4804	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	174
PID 4484 wrote to memory of 264	4484	cmd.exe	179
PID 2252 wrote to memory of 4844	2252	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	180
PID 4844 wrote to memory of 3076	4844	cmd.exe	182
PID 2252 wrote to memory of 4424	2252	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	183
PID 2252 wrote to memory of 5616	2252	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	184
PID 2252 wrote to memory of 4496	2252	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	185
PID 2252 wrote to memory of 3324	2252	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	186
PID 3324 wrote to memory of 1776	3324	cmd.exe	344
PID 3076 wrote to memory of 1316	3076	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	192
PID 1316 wrote to memory of 308	1316	cmd.exe	194
PID 3076 wrote to memory of 3612	3076	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	195
PID 3076 wrote to memory of 2808	3076	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	196
PID 3076 wrote to memory of 3964	3076	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	197
PID 3076 wrote to memory of 3664	3076	2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe	198

C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Users\Admin\dYgoEcwo\ScUAcsIw.exe
  "C:\Users\Admin\dYgoEcwo\ScUAcsIw.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4524
- C:\ProgramData\lMsMsAcQ\WWAQoEEw.exe
  "C:\ProgramData\lMsMsAcQ\WWAQoEEw.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3648
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:244
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4376
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock"
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock"
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock"
        10⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock
        11⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock"
        12⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock
        13⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock"
        14⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock
        15⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock"
        16⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock
        17⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock"
        18⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock
        19⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock"
        20⤵
        Executes a command shell one-liner
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock
        21⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock"
        22⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock
        23⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4364
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock"
        24⤵
        Executes a command shell one-liner
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock
        25⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock"
        26⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock
        27⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock"
        28⤵
        Executes a command shell one-liner
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock
        29⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock"
        30⤵
        Executes a command shell one-liner
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock
        31⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3572
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock"
        32⤵
        Executes a command shell one-liner
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock
        33⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock"
        34⤵
        Executes a command shell one-liner
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock
        35⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock"
        36⤵
        Executes a command shell one-liner
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock
        37⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock"
        38⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:124
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        39⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock
        39⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock"
        40⤵
        Executes a command shell one-liner
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock
        41⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock"
        42⤵
        Executes a command shell one-liner
        
        PID:4564
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        43⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock
        43⤵
        System Location Discovery: System Language Discovery
        
        PID:964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock"
        44⤵
        Executes a command shell one-liner
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock
        45⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock"
        46⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5944
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        46⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4600
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        46⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4708
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        46⤵
        UAC bypass
        Modifies registry key
        
        PID:6124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aKUggMUI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe""
        46⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5568
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        47⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3152
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        44⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4400
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        45⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        44⤵
        Modifies registry key
        
        PID:3640
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        45⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        44⤵
        UAC bypass
        Modifies registry key
        
        PID:2972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fQoYMIcM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe""
        44⤵
        Executes a command shell one-liner
        
        PID:1016
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        45⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:1868
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        42⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:416
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        42⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1616
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        42⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VwsgMsQQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe""
        42⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4428
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        43⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        43⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:5764
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        40⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:6124
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        40⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1760
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        40⤵
        UAC bypass
        Modifies registry key
        
        PID:2360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cMUckIYM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe""
        40⤵
        Executes a command shell one-liner
        
        PID:4640
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        41⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1384
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        38⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:6112
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        38⤵
        Modifies registry key
        
        PID:2280
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        38⤵
        UAC bypass
        
        PID:5052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hGwwYsEk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe""
        38⤵
        Executes a command shell one-liner
        
        PID:3904
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        39⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:3672
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        36⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:3492
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        36⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1920
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        36⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4912
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        37⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nuAksMkU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe""
        36⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2372
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        37⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5484
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        34⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:2248
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        34⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2312
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        34⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5132
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oaoosAYg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe""
        34⤵
        Executes a command shell one-liner
        
        PID:3188
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        35⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:3292
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        32⤵
        Modifies visibility of file extensions in Explorer
        
        PID:2296
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        32⤵
        Modifies registry key
        
        PID:3432
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        32⤵
        UAC bypass
        Modifies registry key
        
        PID:1848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oyEEocok.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe""
        32⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:6076
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        33⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:1808
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        30⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3684
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        30⤵
        Modifies registry key
        
        PID:5108
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        30⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\deIsgokw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe""
        30⤵
        Executes a command shell one-liner
        
        PID:3888
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        31⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:2772
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        28⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:5140
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        28⤵
        Modifies registry key
        
        PID:6112
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        28⤵
        UAC bypass
        
        PID:5928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vCgksckU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe""
        28⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2492
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        29⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:2924
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        26⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:5568
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        26⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4296
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        26⤵
        UAC bypass
        Modifies registry key
        
        PID:4504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\biAUgsYk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe""
        26⤵
        Executes a command shell one-liner
        
        PID:2928
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        27⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:3604
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        24⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5708
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        24⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1060
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        24⤵
        UAC bypass
        Modifies registry key
        
        PID:3560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MSUUIoAo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe""
        24⤵
        Executes a command shell one-liner
        
        PID:1996
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        25⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:4912
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        22⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:6128
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        22⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1836
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        22⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        
        PID:4800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EmkMMQUQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe""
        22⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2392
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        23⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1500
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        20⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4404
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        20⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5560
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        20⤵
        UAC bypass
        Modifies registry key
        
        PID:5476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QGEwgMwo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe""
        20⤵
        Executes a command shell one-liner
        
        PID:3788
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        21⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:5824
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        18⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:3612
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        18⤵
        Modifies registry key
        
        PID:2808
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        18⤵
        UAC bypass
        Modifies registry key
        
        PID:3964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LyoMoMQo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe""
        18⤵
        Executes a command shell one-liner
        
        PID:3664
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        19⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:3432
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        16⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4424
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        16⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5616
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        17⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        16⤵
        UAC bypass
        Modifies registry key
        
        PID:4496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RMYYgQEM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe""
        16⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3324
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        17⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1776
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        14⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4320
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        14⤵
        Modifies registry key
        
        PID:4920
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        14⤵
        UAC bypass
        Modifies registry key
        
        PID:4916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZkwQQoMU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe""
        14⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4484
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        15⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:264
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        12⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:776
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        12⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3408
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        12⤵
        UAC bypass
        Modifies registry key
        
        PID:5792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\owsIgEwE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe""
        12⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5964
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        13⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:8
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        10⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:2168
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        10⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5844
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        10⤵
        UAC bypass
        Modifies registry key
        
        PID:4724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wiAcQYks.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe""
        10⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4336
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        11⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:4476
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        8⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1188
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        8⤵
        Modifies registry key
        
        PID:4212
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        8⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oakgEYgM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe""
        8⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        9⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:3928
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        6⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1164
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1540
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        6⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4172
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zYgUUQoQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe""
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6068
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1864
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies registry key
      PID:2204
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      Modifies registry key
      PID:5704
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:4432
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zqsgwwUc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe""
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4636
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3320
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies visibility of file extensions in Explorer
  PID:732
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:2544
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - UAC bypass
  - Modifies registry key
  PID:4824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BqMQkIQc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock.exe""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:964

C:\ProgramData\RecsUssU\zkIwIkAM.exe
C:\ProgramData\RecsUssU\zkIwIkAM.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:4120

C:\ProgramData\lMsMsAcQ\WWAQoEEw.exe
C:\ProgramData\lMsMsAcQ\WWAQoEEw.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2880

C:\Users\Admin\dYgoEcwo\ScUAcsIw.exe
C:\Users\Admin\dYgoEcwo\ScUAcsIw.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zkIwIkAM.exe

Path C:\ProgramData\RecsUssU\zkIwIkAM.exe
Size 1.6MB
SHA256 9d8447911b365a4bf1734cb9f57549964d56cf9aebb4ccf9f677ed5e533f6b2f
MD5 891cc3de824ec8bc5693930029cda6fe
SHA1 5fadc927fca301a15b7c70eed80301e39ca28cf2
SHA512 17b26c60ba9c31ca9a07d06ed3c6722f06bdd9511de007099d4716913eb392d7ab0f2c1b309ac9c684090fd82ad5a3636c9b6f860505f2fccad4a65facfc39c9
SSDEEP 12288:H9isF/yuchgzr+U23vOrDVjj+xzYIQ+zArUoViamuxJkizgy79MjWY:disXchy23mj+xzYNQA9imxSizgy2jW
TLSH
T10375A8EE8DF20C79F24E0670E012B85B09A9B585139317D59EF09607603D4F27B6BA7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WWAQoEEw.exe

Path C:\ProgramData\lMsMsAcQ\WWAQoEEw.exe
Size 1.6MB
SHA256 b17170e2e250fbe2b8a22244663156f2be7bc5d5b1a23c879f1b9cad39337f69
MD5 526edfa3e12a1e3461db67b4f1ccbe32
SHA1 3daca0a934337d36c909760a4d8d96820778b7b6
SHA512 65ae52ba1665030a40c294ba60d40a5b2ab74299144b760e43573d502db3ace1b851752b712e8db9379fc8c7b1b698e14472496dea9360a50682b3d6e1b3e191
SSDEEP 12288:DPu23q2eslL5tINZJz37ZLytMz6FK6+FmTiLqsrTIKpZUDWIXBpy8eGUA7OjWhoC:XqrzXU22sf6WIXTyfZA7O5wfaCC
TLSH
T18C7543FE207E959740B03E1B44CB296EC46CE710517B4C62E237EB6622DD7CACFA5291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WWAQoEEw.inf

Path C:\ProgramData\lMsMsAcQ\WWAQoEEw.inf
Size 4B
SHA256 673450ddf6f522fa76d5a3a20961146292276558fa1d4196d58301b76c21e964
MD5 883c38ac06767416e9d0d8a137441ab3
SHA1 bc463f8abbcb38a47134dcf2359c2b2670495412
SHA512 5706dfe123dd5e9d39cee22bac1e9c2120393a28b0b9a64b7e23bb47e04cca9e77806271231c6c67704cd433737934ecff88a98e06dc68eb1f41d96f60de8a57
MD5 SHA1 SHA512

Submit Download

WWAQoEEw.inf

Path C:\ProgramData\lMsMsAcQ\WWAQoEEw.inf
Size 4B
SHA256 215e2fc113c54c825a0a976f43e286871181fedb3c73f9114653d8d3479d8319
MD5 4cbd146d7c5aefd8f17ca2d2973bd8d7
SHA1 fe14d49a48c0a80bcdad7a07ae60d17e4a4a9ad0
SHA512 0a247778b152dea916d0499c5f6a891f739018e4d00658e34ac72b5a4cec9cb98dd4bd7a0622350e65b627d7ec20b9aa27755474f6d195977ea35d084798ab42
MD5 SHA1 SHA512

Submit Download

WWAQoEEw.inf

Path C:\ProgramData\lMsMsAcQ\WWAQoEEw.inf
Size 4B
SHA256 44064a769c8e473f6ca5bc7d18e10f8abda359f3389e311602bbcea65faa7d81
MD5 bf8355286e8fb2e386b556dc88380709
SHA1 769527938ab93e6cffb648fdd162ad1b5b2e9fb4
SHA512 dc002bebc323ac588449f0ee74375e3bcaa7c390c2f293f2f69657e3f5e4ea30dbdd3975242c19816f5c198645ea94b3bbf345bf826c6fe26584a726f2910a82
MD5 SHA1 SHA512

Submit Download

WWAQoEEw.inf

Path C:\ProgramData\lMsMsAcQ\WWAQoEEw.inf
Size 4B
SHA256 2f512ee6b0d94606f12b76ab4391be0ebb6fca910baa87dae995c4ff25410acb
MD5 d5c0c92bf40fbc094f1434aa9f21263f
SHA1 b0275543d87f15db8843893b463648cca09654e9
SHA512 96a86542c6a8deb72682866f1571ce4e60a4f095ba619fa7e3a4f7c67f34f16249dee1c2e829a0970b62765902625b0785b8562f55b5915d1c8b152ead21b693
MD5 SHA1 SHA512

Submit Download

pUkU.txt

Path C:\ProgramData\pUkU.txt
Size 10KB
SHA256 3594dd1ee7e3631c98cbbb614ba7af0392c375a235137700d7413f33c36fc927
MD5 076bf1e640447b90028baa8643f79fc1
SHA1 3d653e3be7bdbb653368d72526196bc3ce0a816b
SHA512 206c3a34207ac53294ee2e70d739e51a9c10c74d27840f486d9c565b949573fdfa6d0c9ec64493faf63b328e10cc2abbcb89407391774a9f5e53111c9a07d277
SSDEEP 48:U563KS01Cys3KSwM3KSqk3KSjM83vE1Cys3vzMUXq8O:XKS01MKSjKSpKSjfvE1MvQ
TLSH
T1E0228D312AE8067EFBBB55B183B10C716D37F8522A24CC8EA075424E4476E869DE0F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock

Path C:\Users\Admin\AppData\Local\Temp\2026-08-09_a38776eab70c54fc8297178f3817b110_elex_virlock
Size 126KB
SHA256 d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698
MD5 9adaf3a844ce0ce36bfed07fa2d7ef66
SHA1 3a804355d5062a6d2ed9653d66e9e4aebaf90bc0
SHA512 e6988737153a0996b14e6baa45e8010ff46714fe7679d05a2676cc18e1c653e99227e7507cdae4f2b6a99b3c31478630e7e1ae13d0f7c12525406d8cf9867ca5
SSDEEP 3072:fyUCC0XrT/ltzUKWzzsnQjjEWHUZ/HIO5tg9MlHuPPDF:fdoT/ltIXnsnQjjE4I/HIOrtOP7F
TLSH
T1B5C312E908E287B08C1A1AC21FD5FF2807A99D555BCF1414FC89BF859D34B6CB626C39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BqMQkIQc.bat

Path C:\Users\Admin\AppData\Local\Temp\BqMQkIQc.bat
Size 112B
SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
MD5 bae1095f340720d965898063fede1273
SHA1 455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA512 4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
TLSH
T12DB0924C2C8880FC0D108E82881CC42AF1CCC0C1C394401AA0A30688E33CEA89ED6AC6
MD5 SHA1 SHA512 TLSH

Submit Download

file.vbs

Path C:\Users\Admin\AppData\Local\Temp\file.vbs
Size 19B
SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
MD5 4afb5c4527091738faf9cd4addf9d34e
SHA1 170ba9d866894c1b109b62649b1893eb90350459
SHA512 16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
MD5 SHA1 SHA512

Submit Download

ScUAcsIw.exe

Path C:\Users\Admin\dYgoEcwo\ScUAcsIw.exe
Size 1.6MB
SHA256 60d36f555064c41da372c0591601a53b0feecc7983e26fecc3215915a505c4a8
MD5 293089a9ac71c70dd12fbd68d676ef7d
SHA1 8ce7ba4b9110633ee7f08d6c279f0d72c5242179
SHA512 b36ad4e5f2bfb5f5ed53099672993d0e3eb292d322a35fa0bd23e61b3630437dd1be65e03186b61777eec51135ba63803079f9643571f759ce291bb037b7e7c6
SSDEEP 12288:BOs69xXB0ZKipGSN4kF0Qoue1FZK1u1Cwyny0Or3qEabzN9CwSqS83SI9uPrYESG:Bg0NN4kJouenZlr3qVbnSqxuP5UY6fs
TLSH
T14B7562572198F0EC2CFDD84D892D5E609A426376CC5397B1C18C8A18BFDE62CE7953B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScUAcsIw.inf

Path C:\Users\Admin\dYgoEcwo\ScUAcsIw.inf
Size 4B
SHA256 6a259b931c9a8a06f0879c84bce20fff907812db21bb70d1fe32a86f459fa57b
MD5 b1bf949c8b1c0f2444da39510d21fcea
SHA1 1bf8d2715eb141d43a6908c2a2b8affbf6a569fe
SHA512 8431b17015473d51657867cdfe7abf44e8e83b35424c8c1e0785438ae09ad8072d095bae5ca05b99eb7a325613d515fb7ec1bd2f50d32abeb11f58cf5ffcb346
MD5 SHA1 SHA512

Submit Download

AYQQ.exe

Path C:\Windows\AYQQ.exe
Size 1.6MB
SHA256 71646659903d104ee944241eb9b481474ef15ad914051265d5d96c823f0ec6a8
MD5 c4453afda03b962115c20614ae3eb792
SHA1 75261b37b40cc21895c1f4a3db76bf4ec80a4c2d
SHA512 f6ad648c8ab74f6109d31fb7e5e5532fe278e8ac95caf1a8abc7f974092ccfb6a8e4106fec4594c6e81175c4bdef87543afd7e81d63d0fe6307b2caeef1f243d
SSDEEP 12288:8+PT3Pel87spq6bmZCw9jv1RomGadcRD29hzVCyAmqQm5A:8CfeO7AB2ljgxadcRDUZCyAmvx
TLSH
T17275A78EC2F9FAEB419549168ED7A674EED37E11CAA7A5CCC8903330B6053DD1370629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Acgi.exe

Path C:\Windows\Acgi.exe
Size 3.5MB
SHA256 e63e3cb23e7214482b0f30d4826918a3d94ae9dc7c11982f065daca6f96179a0
MD5 7c785cab82e04f080e62678cf90e6016
SHA1 1d794dd228d39250abc9ff6f13a3ccd6bdcd9875
SHA512 51f9cfadb882d4640f06d88d47468793505c1c8d2feb74bf0de1e3cc53cd159ef27147c131ca761e0fb6f23087b6e67f1279e25f81dd1ee53e51a54db17b9087
SSDEEP 98304:tW43ix5VAUY8otS/mUybGjVZtm4VpFiLRnp:t13ix/AUYfSe1bGjtmweLRnp
TLSH
T15E06A30061953772E408B6F7D8F69F37C1A4D2036E6DAC66B434C78D65E71FB8428AB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgMg.exe

Path C:\Windows\AgMg.exe
Size 1.6MB
SHA256 21b0f5891f7b5e52d5a586bf33ef13a9e36f1c822397669952b9f5d603c3492e
MD5 48163395944801f7da03c24ed8c8932e
SHA1 6823f1293463beb2fe1ad3a7011c071d717fdd1d
SHA512 c5be5a667940cd17fe404b083e357e7bfea0fcccb3370320e5db0ac54e6a4d0a0d2bcb8c821c2f26e8ee003daf65052ee10f6fd98a95c826b729e46bac010e9c
SSDEEP 12288:Bh6jKAvrrQ6glAp4Hul+yOWdFe4yJec7Z3hSp3hDww/l3VvkZR2VsGc5QyNKH:BhLAvrrKHu0WdFEpxSp3hBNCa+NKH
TLSH
T1BE75C9857C80CE9A2ACB581E45F8DF62D686580F98915A3425FE13F5391E3DF9B20B0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgQo.exe

Path C:\Windows\AgQo.exe
Size 1.8MB
SHA256 df9fb0af77b479091fc96ca8f3cb0639be4f2b1d430a6f0f0da591b8ed8e9993
MD5 e6c21a575c9fd0a3d87557dc3b8139fa
SHA1 c97668e7b2f19f42b0a9022bcb9343e99a0341de
SHA512 5545ab0f304c94b8338ae6ee6328d5d9fcdf75f162471707aa3540bdc94613bbed10e1bb67c6ae360396f7be678ce7475be779dfae42bccc295c1599be1475f0
SSDEEP 24576:a+s4ssTDQdAmeif58rw8/Iq1tXCH6rZjcZ1BR3p1RjvjK6H:aVsTDQunrwj+9CQZjcZ1Bnv+6H
TLSH
T1A395A8E2F308F4AC554F4561C40DBB97D236D2A58ECB25DAB38C3BB409E0B690656D3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AiEs.ico

Path C:\Windows\AiEs.ico
Size 4KB
SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
MD5 7b65672ac808bca7c81e0700562aae9c
SHA1 e279f707d5f93cd0449443cf7f70d54a54763208
SHA512 7592be8433d2044e21d2e67cc5905f1ca3d2c05884f99e4fdf4db1aebaabb735ca1d50f6397d02ef2c0ba6e4528ec5fdc4592ef35e0e6d451e0453d5491345b7
SSDEEP 48:De3yb1JCOwbwKDo4fwmF6X3TWDIfA5+wY+wcY1Je8cDQx6k6uoE1k5:T1+DvZO3iMfaOJ18D4TC5
TLSH
T1AD91B289F71398E1ED27323498315D362F61AC27A8912DDE39C9F1A31A7314286FBC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AoMA.exe

Path C:\Windows\AoMA.exe
Size 1.6MB
SHA256 5ce3086759b817fa5803765ea53bce3538013b21746359c5c84d359e5a976662
MD5 602392f2fc7d91d8605ee09035883a6c
SHA1 02a0323db8b2a3df7988d35fc0c48a0a55ff9502
SHA512 b4af2aa258840859b765575ab59254c7add0ed0724c76cab3a9ebe770fa5d963224cf94dc42dc273e852dfb6738462f12c9fbec0955d0abbab75ff5d05df6a83
SSDEEP 12288:P20SJ2u2BVx8rxNG/SWrYa+T9iV978vjDg22alLtOeGpWBy90GB8SYXyUY747ISU:u0SJ2b4LbZQQO5JW0I/hASMQ
TLSH
T14B75EEF19D38C1AFF87D406D0561028B7D90AAC6E7E6A3AE4E4F58E82D1B467CD345C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AsgA.exe

Path C:\Windows\AsgA.exe
Size 2.3MB
SHA256 29252c0ba9d894924df068689cff53db0e45c6c3a2849c7126e371c332e48808
MD5 d991fe187bab3d72b05b8dd93e795190
SHA1 f7540b2e8203141b3bca59380382c83eece70250
SHA512 b45fd0686e90c1df3d2c4aff7f523d09c17cd6196525ed3096ae03f4552712d330ccd9cc8d2ce5d8a776cc4e47170026e7d604f5abc792a300d7b43810684912
SSDEEP 49152:AILctoKzP1C19+0mIYs3KFylGwomdcbh:AILcL1kMfy6F2n2V
TLSH
T1C5B5B2D4D30EB2397469BCF1EF732266A9090B11CAAF36C580540D953DF22768D6DE8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CEcQ.exe

Path C:\Windows\CEcQ.exe
Size 2.8MB
SHA256 517d76af709a2a7342d76f6bcad8d1a4d02012c85ddf836024abb98e515f8663
MD5 81fbea47dc764c4050f110c131395f4c
SHA1 4864854e8031f52b3f1d1bded152b47086d1a64a
SHA512 c901d6c9426e2dbf08590826e908ea2133f2ca5a9c4250d9a1ac6fd2218bd557183a2fd8fe45986c4d25d1fa47d7449a8af9d87bd1515bb2730e3fbdf5bc738e
SSDEEP 49152:IomLsvXg0i8RfOV2L3l/KInwA2tYVLZYp1Tk3xigF2:IomLsPg0dRu2LV/Ku1hYp1Tk3xA
TLSH
T10ED5B3D29D8A9C1DBF3E2D36FFE5960AE8D1D0C8D68E42B972DB540278D04D943CB419
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EEMi.exe

Path C:\Windows\EEMi.exe
Size 1.6MB
SHA256 bb1f3cc6c2da142f9a7e52a76b75d16bf7a3ea7b906f434f3bc4bc8bde6c3ca2
MD5 540b692c94b94890eebfdde3983c3e51
SHA1 f4c3f171bda5de615aa2fd174f894644009dea20
SHA512 af4d996a61c12b9897020f5239c9eb51b6bb53377712b3550f2f6d30de931c8f4fddb6b49c8cd87d928e19396ab2f2a0d80afa8ad16eeebb8e5d6b67fc6ec6be
SSDEEP 24576:po6xnY/oElP5JjeTJ+bWvRURRahqCjVw:poNAElP5JM1wwhvV
TLSH
T1F775354A16A4217C918A1BD82882758D677FB153AD22B113F607ECDB0E576F370E89F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EQAE.exe

Path C:\Windows\EQAE.exe
Size 1.7MB
SHA256 3cbdaa86d3e00381f87d6f407463bc1b5456a143e278e3c7da2baa7f5d481548
MD5 611565c91a8e488eea7a18eab12746be
SHA1 f27762c88aca6a74dc3b25132c62e3dc13567b9f
SHA512 6f8ad4d38bcfc6355dc6bbeac501dd9e0c4fe2a05e5e1e95e5a0630f59e294603cf37cb2cda8a96c2b48e48a2258450ac1d5266a4df665f729eed086486632a6
SSDEEP 24576:xAoqa6v9E55AY3z+jbG6QrlhXi/u8oEO5nP82n:8vUAY+XGjzh
TLSH
T194851DC059FA8E9BE37DE5A3BD46F19FAC43966959903C0BB83071F046511B32047BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EosG.exe

Path C:\Windows\EosG.exe
Size 1.6MB
SHA256 0421483309fb454a39aeae350188f54464c446caee09a27017112c103d2906a7
MD5 89ad3613dd991e7b7e229b9d0a3a5953
SHA1 a5d8dcbd971e4fa7a72b70465c9fdeb3936d6a7e
SHA512 edd204653585763d707ac7deb01c506cadba20b769e04583efb891bb14db5fefc8043c871fac17c92f69011cb122206ed2765d568a265908f600da21cf06ba0b
SSDEEP 24576:2SezR+m3W5/+cswarpWjWRTbIV+iK3qNzFZ5:ezRBjjpWAbIVkq
TLSH
T167758458F2911F7C7BB66C8C2575DEB17352C48A3A73E06C7A38247F16107D2A6C21AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EowY.exe

Path C:\Windows\EowY.exe
Size 1.9MB
SHA256 f7efed2c86f2c73124473739d21d5d317b354444f204b764df2ced8cf5663be4
MD5 95e45055af57847662edb56834e46e6b
SHA1 200fff62c825cea454a914e5275cd5259b570397
SHA512 93f5277366de0ff10d8669ff4cfac91a80bf2017ccab49abe45052c205a78d2d1176f8f5b6639cdf111b413162003bb30507bc08fe256926710ebfa1bcd89385
SSDEEP 12288:9ikFuYjGRH8xA8Dq0Wlu6SFVjFewRTeh0v2Y8phQ45aeu9zbgvLqzqCGYJrpE:9iVH8e6q9lYjFewRy28n5Ju9kG0i
TLSH
T1BA950C48C424ADC98C33AF4316E75A191AF73498E28368DB73731FCBE2C965915CDA4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EwEi.exe

Path C:\Windows\EwEi.exe
Size 1.8MB
SHA256 f0351a64f880ef3263f4a81c30a1ea858699da4bf971c4bd0bedd884d0a9e13b
MD5 088cd7dc1c2530013bcf90a6e1957496
SHA1 9e887dc642503792b18b1be48bf6338b9fc5a0c0
SHA512 73bb7e9713c32f725bddd418fdc6d548887bb53540699c1d547b7d2ac562467c72b1578b66afb954040736386ee569b4884bdbab6bd9d0a0809cc399a1b7b709
SSDEEP 24576:AKgGwozZhBvzsidKqFHa2KjEKs2+tliZ66N215hxxG2L:AKTNXzsiQlFot2+T6w1HxH
TLSH
T188950E8DE3618AC3B9D660F9B602A318A37C45314D4326E501DE2973B53AB6A7FF14DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GIMc.exe

Path C:\Windows\GIMc.exe
Size 1.6MB
SHA256 57d19f8bb7ac0a38ec8a9fab289f060cdf0286ad5acf73af1e28e69a4ced5b96
MD5 180a8302b4138d51f4b47e0426191509
SHA1 84b8c7d2759b5b5847d04b6f03bfe9a4136abe76
SHA512 96dbc38bbf71048be1b18a4e8b6d4a10da4757d1bfadc3e32f3fe8fa528ed01438b38b49d57c3eee977da40a70dd63928f4954f3538b70f507e610f0eb2c670e
SSDEEP 49152:aHmaSfV29IWCN+FW1Z3s+VL45GBI+z0a:zVQIWjFW7sy
TLSH
T16A75CB48AEBDAB8CB81987F6F0DE460507EB80F85577DE9095FF480D609AC5CEB42D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GYcm.exe

Path C:\Windows\GYcm.exe
Size 2.0MB
SHA256 5a4c608216286f199c8059705f21103c836f7bf125913ae6c49948355cb446b2
MD5 6b80aded23e83bdc2108f22b7dafebcc
SHA1 573bf80ffe5133fd03db4656c514bf1b9c0d513a
SHA512 c6f7d792356274eb5bc08803f11b8ff6c9e6209eb6c4a762bd584058b0fa136d8172348480cbc52f657fc96066d8c648ffa56a45563a6589eac83e7a39dd8c23
SSDEEP 24576:wctcRZ979I/GF7+RC9ExSyQxW4b6Alew/b:wcGZ97O/G39pxWu
TLSH
T148A50F4DEDC33E90BAA7149947A7C6E1CD2877170A1D27F005FBE2AD943A3C2E54825B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GgYs.exe

Path C:\Windows\GgYs.exe
Size 1.6MB
SHA256 b8e93046587435a669c0fc7bacb05a91827cb4d1d686c87f07aa4287abd74e6a
MD5 ebc7bad7924ae69099404efb5102bd4a
SHA1 d1eba87c720d3fafe04fc41d38fbf6398b9e38f8
SHA512 e340aa98f74ea774a1db469abdf934329caac0b768d61f46958df4f2e209d6263bae78eb62b3799e3b568bfb027d2e530970857d4430b7918f8dec21f687f2e8
SSDEEP 12288:EGKWV67rFvf166QdS6VZhp++pA/aJeM5GLP+NqoiMJKpxj/QSlCnIwtFu:qa6/Fn16vZ3h3AxPGpiMJKpxjZl6Iw
TLSH
T1D175878F0FD9FDBBD97CDEA0E18547E278DAA14221063C42970BD06519B13CEA158BF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IIEm.exe

Path C:\Windows\IIEm.exe
Size 2.2MB
SHA256 492b3ed668d8930f57aed1a63729d1abc9c6d0f1f29a8584dbc2aed9c4ec3d21
MD5 f3f8b5e68ef7e52445a727b33a2cd15d
SHA1 baebf07c42ace371a0a4abe07a1b8240c23dc0c1
SHA512 39b6c8981e7c7a61d11a50905eac5e6e36ed951f085b509785cd94e65c8c4c1cdcff97dd37d77b846d33eea5e7dec5d89553b90dacbd0778e7f8b47094fee7f1
SSDEEP 24576:/13g/HeNSFqTwG7yvIAGSVbVCzq0kcIT1qA+JJgim15LU4Q:/13gfekgTwgxUCzsF8JY15X
TLSH
T16FA5202F02B301AF7BDE719B91F34A6F3A122EAC428695DDCC15F55C1446AECCE9188D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IMIE.exe

Path C:\Windows\IMIE.exe
Size 1.6MB
SHA256 948d34aa2f45bdaf619cdb1a11f4e3e891c5e3f5db53cf70919ef9929f011e87
MD5 7c600eea87a25b29df79019d0410f73f
SHA1 acab3b1f09ff0e9f75968b5bd22221aa4843fede
SHA512 6221799bbf963a6ed7a9b85fe61acec9f24749f42cdd2f766927fcd3dc8e397195a65ea75b640e79da58b3a60b9a4302f1faeaeea02f4251bf3e78d9eaf482f8
SSDEEP 12288:GPJmPRCnlUfNJCeCaxsDkANrFfgdq24EtFEormd9gTtFohvjBW83Cpl2oPnl+W6+:GPmBLCdY8CuEtFEoggTsjO5
TLSH
T13975BD6BA2DB3450281971970F635125C986C0B73BE1C832FDF9336B2DEB532A6E46D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IMYU.exe

Path C:\Windows\IMYU.exe
Size 1.8MB
SHA256 e481bb420a98d8020863ca2ad0ce4cec01d04b19cf3605e9a4bc9c1e89bd16a7
MD5 2f2fdb59a5add956cb843b6de0d773e4
SHA1 80eaa737971d7d09639eb4b90dc01827fd824178
SHA512 00b39848eafe08c069cc32e3f36b934c8fb44390098d242c9af0dc49d3a48c2251f0dac5dcd70f07b1c3e874c89383fca1476b19dd6a220f168a529168c5f844
SSDEEP 24576:9QvanB/JjJ9RC7WXj72sAxBxpBQ6ImyXw5/IcojDe:9QKB9Y7BIcou
TLSH
T14295A60BCE4C90FBFAE5DAA8635A9E4CB70731F81FFA57EB40A42768015487B957D120
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IQIO.exe

Path C:\Windows\IQIO.exe
Size 2.8MB
SHA256 be9eb92bab12b4826caac08dfc937602a0bd88cb7bcd93b7786bd435f0116bcc
MD5 4a0aa251abc038113093f0525a3c91a1
SHA1 4a20e52532b3afd649132a86ea2b5603f2257cd4
SHA512 9ab14c5454e582106f9473b03d4e59110e2af595c1c0410aeb2cdcbca2368333b492a7b717633c8b6a4db875afd4ad0e866ddf738c3a26a9fece98018f2349f2
SSDEEP 49152:yLi+998O/dGTp4l7/NDKcDHCKXpPxSYgIBvJ4Pq/V:yWUrVGT264HpZPxSYLB8q/V
TLSH
T196D5C42ED5C086560461CF083AA4F5B3B9CAC5FAC2BBAE50A10F1066FD56E7D0797DC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IkES.exe

Path C:\Windows\IkES.exe
Size 2.1MB
SHA256 6559b7278501a9faade647d854cfba90b8c8b67a8782f1d12d681ca4b95832ab
MD5 4d4cdbb35c8694c01954c26a764a6909
SHA1 7cf5ea7f02d62dc3f69f498af4871ab48b4178c1
SHA512 0317eb7a6529bdc9a77cc9e15bc25b6a97c6c30fcee870c395feb6ff4bda59c80aa9e2f9adbdbaeb7b7c59f949590c075317563a30b3d689c84cf4ad5e9a568a
SSDEEP 24576:JXlQSG/uKmVMGm0BxWCzpjBSo2uHSMpmoyjsz2uhx:JXlQ7xmVMArZTHCoMsz2u
TLSH
T113A55F47C3BEB850903FD2D781408765FABA477B673F12D94A4833D89B4D64A2264F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KEsq.exe

Path C:\Windows\KEsq.exe
Size 1.8MB
SHA256 83eba7306f17c7127c1abdd166477db3f6fa1c78f0fd26d5755e195fa0852936
MD5 79ff339be58b94c7485bcebf8f13095f
SHA1 6993eef376b3a0a3e7f3468178c41c6c24559508
SHA512 139dd47748306c12902dbfd5c315612294dc91cafc9f600a36a03ced1d54eb720cf5d588bfcc4a1087081b48cf554150097e5a75ddf52150784de0deb73cc3c9
SSDEEP 24576:w9P6TnKoMacCwyAU00gCXuVX0SYUxfph/:w98KoMa7sU00gdVXJZxxd
TLSH
T14895FC91290B45CBD36497321692D6FAFD43378C36E32090D71E4F5BC9B2CB38A6B619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KYke.exe

Path C:\Windows\KYke.exe
Size 1.6MB
SHA256 98fca9784b0f141c3a3509992724b6c19078ac6c56b433d5196f063655f80cda
MD5 4360ae54fb9a183d4483d92275672357
SHA1 904dac0e424bc28f9a87da26be760e5afc19e614
SHA512 0e783adc2552237dbecd7ffba05bbe6ce5d138cf2b2167d3b53e94d4418928eef353da4433469342dfb169b841ea1602b843fcbcf3c5e2373e7f56cce6807031
SSDEEP 24576:B+sox2wkchL/q2WUJ9Iydhe+UbWgd9PDg9mmkbhQZQF9ylbomtc:BV6Ikhe+AE8muhQZQF9ylbomt
TLSH
T1267576E9D3895657BB2262E7CD7861DE3F73EC64E635601248A86E4CF4307883243B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KYwU.exe

Path C:\Windows\KYwU.exe
Size 1.8MB
SHA256 1d9e7faa6aeff9af943f74fd415964b2504070d53ed726fc54c85330ddb72ad0
MD5 8dbb5c6f02a8708baf742e37ce05086d
SHA1 001d5de80cdee8c3a2bc8200dbc85114d54208dd
SHA512 1e47f9cb582973e4e25f08c94db214419fc9f935a24aa6c905d37b76174c4e122e77b087470f8ad6644dc58c6ea78e58648d9bbcc7ba024aa3248bfcb63ceb2a
SSDEEP 12288:+9OFvZzzGrHzTetZ3EYNMLenJi3ViO458zvwEHQgJ+8ArmyuYLtRniSZqofX4Gur:OW8TTe7EDenQFij5L9ayuiZiSX/4j
TLSH
T1F995438BAF3DCCFF995477B07EA770C638F059AEB18E38166471C04E5CC3126A6462A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kcgw.exe

Path C:\Windows\Kcgw.exe
Size 2.0MB
SHA256 1af5b322ba6b94b0cc91316817642f71341652d54fa87f541780b12d527c08f5
MD5 b528764142056bdbaf8d01495a61b8cb
SHA1 37ab6061956bae1d98c145d23ba4d2e7852458f2
SHA512 1a6c5b1534c393a9b3e032786c7f9e3d35e04ec50e9fa1ae52d1d16c66f644a5f0c04633b67fb4d05601dccdfb6f83a392ac106f74504cb74f5c819129632b61
SSDEEP 24576:tJxJHFI0G8U4LfiEUUU4/4uQJqMjCTvJ8cuG7XXAfxiWoSk:tlH3jiEUU5QG8cuG7XwM3F
TLSH
T14AA5C60B692215439E9CCCEC3DEDCEDC8AE7567E54D06606700CEE3496167F8AEE3528
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KoQG.exe

Path C:\Windows\KoQG.exe
Size 1.7MB
SHA256 e7afd5fe3cab2d3233998c1d80044d428bf67865516df7bc4597483ba915a5d3
MD5 73152bbe60d49221b8ef9294187e41cf
SHA1 0afe05411a4c22de47a9bc594fd1f4e0d6864829
SHA512 00c496d55101d1f5b91bd357040c282ac06fc8722512423fcf6e3b37220a810e9a180ce70b3417f3b27272b716825cd45d60647f54b77d37ac2af9c294fbccb3
SSDEEP 24576:lHpMchlMfSmk2s2U0XLBWmPTSH77k/HDMm:TMKlm5kL0XLBWmP+H8f3
TLSH
T152859655B73F193090B27EBB558C2FB9A57080B72BB22FB0A15821D8E47D685ED1C87C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KsYC.exe

Path C:\Windows\KsYC.exe
Size 3.1MB
SHA256 093a9bba7af02c87cd0abefe674429c9b1bb905a0923085057263cc06ec98f20
MD5 be9384cd1d42a2e3e431dd1ed6a787df
SHA1 398866299bafa892db4b205c75795e764c5f7757
SHA512 f17adfbf786187be668b9c884f79e77ab4b5211c4dac40e025fb20b3f18a9aa1da90e7ccefd39ae4ca518d6da52949bf28e25d4f32079d5862026e49126f400c
SSDEEP 49152:7Dii44gtemVxzumcCxQnCVoWvTv+y3Ea1iYqEp:/44aem/iLCVbj3EaBq
TLSH
T19FE59793026061ADA5EAFD49E721FB11A8B6B7C7ABD6CF6C837F8C0B1D150C563C6481
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MIgg.exe

Path C:\Windows\MIgg.exe
Size 2.1MB
SHA256 2a485754edde376084f08542bf8c143018f0d107445d46d86e75c098a0ce63f0
MD5 079ebf08844b83d93940bafed6159839
SHA1 cd9ced36ec568e0fa6106c9e2e7876c9d17ca188
SHA512 6cba83330df20b3648d089f99a0f6aaf3aa4351ef1276c688a2be43940d73308a6c9e90e15ca16a3a8762703ff94927ccc21fcdffbe2570290086ab520f9e6e3
SSDEEP 49152:D6W6666U953KuVv9TnlExWtEDbMG/BMlL:D6W6666Uf33VVLlExWGnMS
TLSH
T134A52D9FE208F8A11685DCFEFA3918D4656885F0003A2E697D5F9F4C6E870CAB458F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MYUK.exe

Path C:\Windows\MYUK.exe
Size 1.8MB
SHA256 05b980db49d1088114cae6ab29e93c33bed16e8d38791c91eaa93b862f330f1a
MD5 36a96f7559604008b419628b3c1a8263
SHA1 1c846f1b743d8af0d072623b044ccc4eb0868ecd
SHA512 104902f5fda0748e462ccaed154a2410510b8dc73f2d0f567176023b3b0c46ecaa583abe0b659cac4a784a7a1d309d49437a80d5b341ecde81d968f2cd92ef73
SSDEEP 24576:3l2gQGBQyBxEao2jGyO7f3hcj5hE7y3hv45K1:12d4xXo2jG5r0Xqy3N45K
TLSH
T102954DDD32FCBEC88D173A9C489D7D9BF2243992E8C38D5A9F001ED625F12B521E5216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MYcU.exe

Path C:\Windows\MYcU.exe
Size 1.6MB
SHA256 d224a7b20b982bf94b2a0ee93de01a57dd8c432e267a5c1347e9914645989e6b
MD5 4abc4c7de06c01903d649547c1110c77
SHA1 eb6175951d011aac5d80d832811a1e5606fe1c8d
SHA512 9e13d9d83df52565444e887dfe92d79f74b82de06ea173b4a7d906b611c2f5b61c1cea0f3b6f669b53b24cec6180f6bfa76c5f362016beb1795cd62430297db6
SSDEEP 24576:nJmL0ITdP55I8iKIAlrnQa8WX/bYDdFVpgM:nJmoITp55ITKIABnQa8WXm
TLSH
T176758564D225B8E06F98FD0B0279A19D7094553C31FBEC579B893072FC4BBF921096AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

McQK.exe

Path C:\Windows\McQK.exe
Size 1.6MB
SHA256 41af8fe552c25a08b06128e02309a0a69df2ef274e657a3746db1a2f5a6fa8ee
MD5 c365a17c5f224c3db1e3a133e40eaf19
SHA1 78a114a1d1d4a0e93585dbd90f3d9baa4a1cc94d
SHA512 6eda35db459471ed423425b881b42cb21a1c19ac761be5b3a75ed558a9649d59732010d97b4458e14ab48c87152ffa700ad0473164117e729b4dc8d1fe95bbd5
SSDEEP 49152:Z+N14G3lM9g65IO/cR8qK86x6RthQem6:ZTgocBV6c
TLSH
T1B77554F8B26BF866EF67F2CDA6444EA4142C5135F2209C9633AC2F219541F141CB96FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MgwG.exe

Path C:\Windows\MgwG.exe
Size 2.1MB
SHA256 28d5798fce9cd096fa03d59cd5b06e1d8006c94e74dbafb792facbc945791282
MD5 cd63ca424c99eb927a2adf47f37f4cd1
SHA1 150ad25956c7e108968f0c2c3e7598e7184d9956
SHA512 09db3c3ad99ab469ff01c13d399ec4376d60bb80e6034bafa17ccbfa543c3b978739a66e1118ab4af0fe0ef8d038decd85261f805b754bd76a5dcde72697d58e
SSDEEP 24576:kMMHfyf3DiBY0vG5/Qxs3wLLdgzCp4SHZZnFjunHAVXHYhuuJIqwjL:kjfw+yes0+GpNZZFjunHAVX4huuJIzf
TLSH
T16AA54E28C225DEA4F687D29564FBED1862A7037936375BD1960B846133074DFBBBB320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MkME.exe

Path C:\Windows\MkME.exe
Size 2.1MB
SHA256 94ca297e24d68b5f713668c3fec396f4c7ca067b5c1626b2baa3b32a58943dfd
MD5 b131350fdb89611e1b9ecaba8281c470
SHA1 54ff569fb416db7d996467dfc7a710edc9610dda
SHA512 e793e0631e089a4454aa346f3ca76ead06311bb114071960e65dc62275d2f84c2bb7c6fdcf6de2aa3f6668bbae705994336508bc7524e3bbe51bdb5c91c98204
SSDEEP 24576:Xn1EjHe8690mldoecN7jp48xzdMFe5u5+VgtBmWkH3wrQtlOkStsotL:lCZ690mldi7jyFNsVgT+Acctrt
TLSH
T1A6A53F0E7A38DBBA75F078B1AD1D15F63D6AF1854D1F280D99EC90E0871CEB1193B42A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Moko.exe

Path C:\Windows\Moko.exe
Size 2.2MB
SHA256 77e37d38cbb9098de2bcb02bdc27b8e704514a72e1f5b1d230c86b2f0050e648
MD5 e514930c2fe04a40822b6e86f7234067
SHA1 f5f63d7aa572a1b0bc0484d47226afb332b33465
SHA512 97e3a6e9c9e3d1fb9a523e8171370cc7d5388debf88a6be5e1e4e98c06dc62925de61a66c906f4c45614a49d1d0572abe66f32e409c88150089099f15ea167c6
SSDEEP 24576:IVGrYi7rD2A9Yyj6lqllsZ5Kio2kwCTKnes6uUUC3Tj:IVJi6RkxsZ55ZkF2uj
TLSH
T11FA553AA433EC169330316B01D4F67C16BBFB41FBA1C97B2A52E137B0CA978995D3542
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OQok.ico

Path C:\Windows\OQok.ico
Size 4KB
SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
MD5 03c62b34b94a861c4f99017a91bc749e
SHA1 2ca36583370792d9d56be7e5db98417188adf5a6
SHA512 4260811ca36c05c15db789932b24767db68b0dfa1a0590e8d4f69328e208c38693e978d892e0d229756a8ab9092265e19b0a0da132f0542f8460be54ba6371f3
SSDEEP 24:su7zwwwwwoRLM4IRS00000xwbU66INLbXxtRmcjtjmjFj+RIW:tzwwwwwGLZ+wA6nNnXlNjtjmjFj+RIW
TLSH
T1CC91282223494C36F8D4CFF0AC9ABA956188BA544FD52EDC2DADF01E117EBF649F5010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OYQK.exe

Path C:\Windows\OYQK.exe
Size 2.4MB
SHA256 9324d31c67447ca81a5140075c7c96133bcfb3957704e69d789240740193bb86
MD5 ff6fc67390b1247ba41a11065bca7e55
SHA1 7eb7917b33a0aded3a5b37f257900b42ff926feb
SHA512 4d1291fdc613aa90a4392d5d4e8bbc5e7ea1aba1ed276409480a92215ed9cc1fdf2cd934a5f80c1fa490a70a753a5a2d012d159cd72997b012aa2438c4a52ee2
SSDEEP 24576:fz9C+G7xKgxyAcTAAh5ydzukyyGr5/vLqk254dTQbwYPNh1R81kKSUg0zCQnYd8:79w7xKgx9Ah5suOGrhJOtbw8uDl2Q
TLSH
T1B9C5956836A95D0EE9622B4793241E560881D70FFA37729BC38B3C997803D7B5F513B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OcQM.exe

Path C:\Windows\OcQM.exe
Size 2.5MB
SHA256 ee1f53525e0e69a160a4f2ad855817497f984511eae08fe46711a28b6811a1c7
MD5 9944cf33ba50b6c92370685cc88e0eca
SHA1 e494b9bde6ef5d9cdf456add558d1ba2a9f29088
SHA512 42a1d274eb6c9f83af054fb8f66f6a42a2829e1fa320b04c8a2c559ebf2b5b1f01888a5f4fec0c80f706ed625e7a50c9224760a75e4acdb8b3d28a87932a68e4
SSDEEP 49152:DPglVMZ0AlQojAFLC+Es1t1x3XucJPzS:DPglc+yAFLCi1ZXr7
TLSH
T188C562AA4674AC107D7CEDFC92CA2390066E558C610698E234878F46FB614DF77AF38D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ogsm.exe

Path C:\Windows\Ogsm.exe
Size 1.7MB
SHA256 ebbfbf874aeee47d601d04a28c6a29daac84e35947b5136885dc3df6d9405de4
MD5 807b3bb8a452d6f9f3aa9a3157392150
SHA1 fe4075e26505ba93003d6fba41f63fb1ebb48287
SHA512 c62e5815213fbb43021ae2007286b8a58a3a43fae022eeb463f4e8941e09c573c89ef309ab0059aa0ccdec873c2586323d6b561fbd422fe430fb41bd0b4983f0
SSDEEP 12288:aPYWX4l5OlXa3zQBL5m1UOfjK38oYF9KUTBAAa9YSfNqni/YYEl/iMdUL1hDx7b+:awS4lqqMC17HoYnfqfNWiw5/i7Lrx7
TLSH
T1C88565DF445DC8894E2E71E60D55FCF8ADAE4C5D0D18A2BAC92A8B27E218DD8C3F7054
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OkIK.exe

Path C:\Windows\OkIK.exe
Size 1.9MB
SHA256 f2bdb4d13b4dd178ea769e3ae37d1958347e40865ccdd1c0bdee0054c9ad506d
MD5 c620ca2c86f0e063c5074ce44922c694
SHA1 f4f8adf46257cbdbd1500c4243cf0cb03d2bc924
SHA512 3cd4f9ef3b16cb09d8a0b288637afeb89541e215a6fac55c7327c8bf49b9411f176d0c5eccb958311334a20f5b2de7ec5a6873f2b6934ce7ad5eb47fb9fb9e8e
SSDEEP 24576:V/GKNULQa+pdm+styQrXavhTxdsfemDw6t/74a9mSRIvNV7oQ+URtiqOd:/OtpXapTLaDwgSv0URYx
TLSH
T1EC95E759F813640BD63A5BC24946F70CB9A6BFB9156A9DA2C46C920F03CCF4FAD4053B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Owoo.exe

Path C:\Windows\Owoo.exe
Size 1.6MB
SHA256 2021f1814b6f7bde3e1beff0fe1fdeeca4d17917c68c5e859fd755a99746b00e
MD5 ce9c0f0f7a9511085f26d9e2e75f4c4e
SHA1 34a43f768fd2306c7b59713a3d1c9c4fb2cac192
SHA512 cbf188479a667d004eab68549e3a658d8848d283e6c549143819e4774c958da73e6dddf87b8b12bcc1c964dfe7a5185b560e3d41e9712cee1cb0f6e5f066fa59
SSDEEP 24576:U8utdjyg7fIy2yWDvA8vLB/HEtqthAi7:zut4P7JdEMt7
TLSH
T14875ACC78742E2E21817DFA10521A6E6D5F6C128C2E57B12607D170FECCEB9647A4E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Owsy.exe

Path C:\Windows\Owsy.exe
Size 1.6MB
SHA256 aa3a8d3d6bd80209a6a58c8e33ef0cb6f42bb145e7b837437a75cb933fd75950
MD5 57f776d317816b437eea7a2e502a5142
SHA1 b52d33395ee8250c0e66295804039e49f346c7c6
SHA512 16fcb96604d6b60d063879284ea985b437aaa96f380440a70b1dcc3be244c2952b7882d3f1e667e293010aa99222ffda9d4a104b88d1f0b770f3270e99c95e9b
SSDEEP 12288:9RPRPLWGq1GVt9wERIS73IYpO5zMr+xMscDnaFCfD6HYrA1B9mwPs67he8JqgG4L:97qERISs1MKpcDn4UCtbgwxeX4I2
TLSH
T159757227D96A7630959B54E38D62A8B6073D1B33402A4A80FA3DAD131B2F7751DCF78C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QIIE.exe

Path C:\Windows\QIIE.exe
Size 1.6MB
SHA256 0c24093e68fdd8b191f3776b0e41e11e488b7d3efea1a036ec5d537358cdb6fe
MD5 79d12e405b0e3598b262298a6a4743dd
SHA1 45a4fabf5f08a49495053aeba67f3d0d42649c54
SHA512 7036ad4e5c2d4f56d3d97784501f0439223852df7de4f8785857d7e37b394d015c12c57ed711a511002d0899921c4972dbf148f7fdc3253569cd4d56e815bce7
SSDEEP 24576:VK1LDxzkCSn76fY8I9DdYx6T463W3WwWCqvostRagWb7A34FqoRd5Jzdyulv6mX1:V8HE5QcTb9ASK
TLSH
T1707596C5D0229227EAD0DECFA367D74E82593F5E0F9CB5199CE50A130E542CCAE7C926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QIwc.exe

Path C:\Windows\QIwc.exe
Size 1.6MB
SHA256 51ae3c2ed8d8b32b2d9e5594edc7606cf762bbc21e8aae9e4de477dd0c50aea5
MD5 eb5733463916db6c90f24fddb547ac13
SHA1 7e62112970769c6efc3c3509a73e9de64906c12f
SHA512 ea4b390035ecf5aea8d509005c00256769732191a26c94e12ef2ccba6c1854a919a2be4a3ba7e4f08a99e720fbbe22ba5a9cedafcd2185316af33fa1f393ead1
SSDEEP 24576:pLvmRQPCCXkKdmBPrZAHB2jZjiyJCeSuFpXQ6H+dQocEB:pLvmK6CXZUgZJ
TLSH
T1F075DBFF0B5B57EC048C2E29860321E9967C8FD2D798C0847DB780BB8B5A2ED5D9B145
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QsQm.exe

Path C:\Windows\QsQm.exe
Size 2.0MB
SHA256 a688734c32c119b9f8262956386ab8ca63c8bb4bd77621e88bedcf2467b450d6
MD5 70df21d5966643330af7f167497f6bb0
SHA1 8e3df88982a046c706f7d2adccd88421e6d7828b
SHA512 7cb0b040b430064e76a57d70f01a412e18fb9d10563caa542fb0e0e745d3c09d3099a91ef13c52908c1f9acfb91919dacee6c15d6a03a6998eda8997cb867803
SSDEEP 24576:kxcTDZYwqt+7Ok9WvmWiCcJQM65e05BX622KeDAum5ApErg8bdp2gHyHmo:kxgVy+7tJ0Y4em5AmrfdJZ
TLSH
T10FA5FABD43D5343644467BF9F78A035AC0F1BADE56A1C08A689504D3131AE9BDF08AFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SEQk.exe

Path C:\Windows\SEQk.exe
Size 2.2MB
SHA256 7eccfd014256d29932fe404c9ca97128b0c0b292d6293bfdabf87b02e1e6210b
MD5 a85da59bc1d4a3fdf8f0d3191bedfc46
SHA1 05d4c35ab128d81a67c21a978b7a37189dcb0ec7
SHA512 b0175372f7ea651dcd5808abf2cbc7126c81786a31b4180226e98d77ca1cf3974b1a2a80818e8505e41ed7f8eda6e181d7966da748506aa4146440e6ac182d3b
SSDEEP 24576:coFawkXosiK7eENxgMkBoUMGADvd0TbJXlRb7Dd84GR8NEiV8m1Mnyn/GTb71Ye:I3xaM9YB84GyZuTbBR
TLSH
T10DB572825A88B161072FAE9D8E147FA2A7FD62F5BABF20015C3715B4DED790C205FD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SEYc.exe

Path C:\Windows\SEYc.exe
Size 1.6MB
SHA256 a17445c61bf596f8799ae90859448aa0cc83c3f15d48aefc691c08c9b9af3e1d
MD5 9c742bf86ba33efb11522b07f3fd4653
SHA1 740c35d6e906671027c845301536e24cb920db2d
SHA512 93a6b9db762c5a78501a5bfafaf821dfa2fcf264c4632bc23e25972cfb413cec1e8b7d79fc33518d86d6011be32f8943acb532754e5732feaa6d840c140955f0
SSDEEP 49152:qqw0y+qzncUpGmRi/jrPZnZNhaxesq/Nu8q6:qqw0y+qzncUpGmRi/jrPZnZ7LV
TLSH
T19575CA4C3ACB0F0B2AB6830CBDB36179B79904ABA5D2C4517D42E954A58BD3FE50F5C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SSIg.ico

Path C:\Windows\SSIg.ico
Size 4KB
SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
MD5 f7858e48b74b107ab160878eb400128e
SHA1 d8cdd8be514077e101a9f0a0fdbcdefaea6aa72f
SHA512 c2e950c96da0c901c550dddf953dee3eecbf9a1cb509100c93bb034351369e1547bf5b97d4aad78e2bdd516a09ea28e999e597fb0a91fb350da7b7d3ec08e9d7
SSDEEP 96:tzwwwwwATljxEbfbqacJHTTejtjmjFj+RIW:hTljxEbfbqacJHTTE
TLSH
T16E914A3723481C35FE514DF0BCAA9A9CE088BA1887C62C546BEEF59EB57E8C209F5441
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SYAy.exe

Path C:\Windows\SYAy.exe
Size 2.2MB
SHA256 341f3febf8b32ad4c0d61ad63125a15a987354c35a505652cf535ce50197978e
MD5 3fe30e182f80d2292fc31b20155c58ec
SHA1 9da15363b24993ff92321cb5ad66a91077240727
SHA512 23dcf5f2c28710c31127a5f3c61b619e161c26239d1bc9614f391ae2c6af9667d6bec7a31c115129175e239198f3f93a120188d8d99d3daaf743c52c898d7b2c
SSDEEP 24576:OuTRLQX3lPxQDlVtRQWLEwmdaSJzdq/FjAqe++JhfvYp3O+HdxdSPGNyaLak:PZQFJCSDJ2de++7IMMxcP4ak
TLSH
T12AB5965B4C1D7811CFEA5AFC881241F82ABDAFC8E249B5002626AED41572723D67FF71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sacs.ico

Path C:\Windows\Sacs.ico
Size 4KB
SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
MD5 04e9ffd28b9cbb9ca06e99dfd0c7878b
SHA1 44d1ff600e81c6014965bb30684eed29ac7c538e
SHA512 22bf260e1ab53d90c8b3083cae8d9fcfcf6ee19fe30d61c6074ddf38823afa4bc6bd738441bdd3e221131f4e87a750c03f64ac78cffa5648cba737c0c623d888
SSDEEP 96:xB+p+3sHL25ogAJpogoMotGcz55Xxm/frxO1Q4Ni:xBK45LAJprLq5mCI
TLSH
T1A1919C6DD785C54EC0E94F76D3364C77E1679C2B8E79986E024C31EBAE321860829D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SkIG.exe

Path C:\Windows\SkIG.exe
Size 1.6MB
SHA256 98c69986a16f2f0073a26e4445c4ed0bd274736b31f46bfb7098fb0be0034afe
MD5 8d01931f73abdc3ee3113615ea708b01
SHA1 24b344adb1cb802940d330c1b099048c0b80a250
SHA512 fb94b0cdd86158b47ee01712a34d2e669a40d5e55ff139007c665a873ee55845b7abc36d4c8cbb7eb3870d386c9d5be2ee89b0e63b8cf8db1f423596f27d38c8
SSDEEP 12288:n5j57yDgfSayEsnCgDLAOQaVYnS2v2oAM1xsuL:n5jhOg6xEsPD8OQaVwSZo/ku
TLSH
T1B575A63E4A4D40B240FA12959C4B9EC52785FEED1FDB65BB3B799069E9C9F02CD809C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SksI.exe

Path C:\Windows\SksI.exe
Size 1.9MB
SHA256 f2483711bfa6bf77d4a8eea46af43547c71209a5fc41fd50c1faf1f7ac77086e
MD5 4ef270b14324e58116355361e63b4c73
SHA1 ff0ea6ccfe2b275b215f745e7ff7648112c6f298
SHA512 15a02d0fcdeba5e0440f9972a1f427e7c3391f320725ad052e219f4e489dfd94635917e4b53274eae17ab6af62eab499be1109b46636ca4ca05d22482ce5e932
SSDEEP 24576:sEFtGABUvZoJH3/YelbGe9l1RbpfKIAhMC6EZ5WbRcQoPpf0fJKjWa:ztGABUvZoBvYelbGe9jJpYZSc1x1W
TLSH
T1A695C9631D3B2E101641098BA7F5AE239FDBB8516773BB271FAF0B32E9780498E11574
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SoUm.exe

Path C:\Windows\SoUm.exe
Size 1.6MB
SHA256 98f466b773a007e5b3ae4f68483b578c3413d980cdc25ac95e46cd054e3157a7
MD5 e1e994e1bae002b289b1a8a96de9195e
SHA1 45ce76aa9d2f9395aaa7b5350385d7ee41df529c
SHA512 5d3dcd4d6f7fadb0851272a7dc894917fab9e92f06abf9b25b34b1f8fefb2ccb6dfa9ece977a30ecabf2a43ecf3fb4deb2911db65a98c465125430b82971cac9
SSDEEP 12288:uJnCuknIEkOxqSbh9gBq/vRPbh/Q/8rxyCVAuE+LgoKSqZHto:xn9kqhbh9gBsR9Hr5VLLgPZNo
TLSH
T1F475A8CDA1CD3F96021554DF5FBE8D06AAB07A4A64DDB2309C861D28D0B29DB8C1F5F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SssE.exe

Path C:\Windows\SssE.exe
Size 3.3MB
SHA256 a3bf9e77e0f5a82c8e424c2818804f31899565aec723ca0443a341cb1548782b
MD5 621242eea965a718d02c0ed696b3d2a9
SHA1 4e04209a4c90bf2d9eb36cba8e7d4843faab9b20
SHA512 b050cc17420124fb8b4e5e7519cd7b659b82cfe8591241c141ae63760e895824e33b0bbbbcc80ef47ba2836d7d7ce88b4c1521bd7166cd925924031433a719ba
SSDEEP 98304:uXjgePahEfr9/rZFTt+TEndVRrmW0QrXT:Gg2aIrf8Qd7hX
TLSH
T1DCF50990DAF7566CB9C5B7316C2D93415B0A38708E82706A38520BC76F7F5BCE1DE928
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwYK.exe

Path C:\Windows\SwYK.exe
Size 2.6MB
SHA256 a45345c49f82bae87f4933eb512c7cbc7afdc82a5fba4c2d1f5c46b90f9023d2
MD5 482fc2a5564e1f7614b577a1ccdf54cd
SHA1 04df5124dfad571d10819fbe47574d4d4dc4275f
SHA512 97a09f3c9a866c7ca6b801e41cd47a03e3f1df32375652272a4cb667a8132c4c4139c7a6088e62876b05e567f7d82817405c65a2dd7e4acbe3101578162440d3
SSDEEP 49152:yHpJv9sd1g3CfDAOnmOTLVKkKLpXDimA4lmBkm:yJJv9qpAsTsk69eNWma
TLSH
T1BBC5B34B5501E0C6830CE5FBA6AA698320888DEEB4DEEB8FD895465FDBCF44D055D03B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIQM.exe

Path C:\Windows\UIQM.exe
Size 1.9MB
SHA256 d3b39d93bae1170933a548a0d967c197281f8426901b341491f4c2e3d2e4fe32
MD5 b13d03a8901028dce7ffebdde1675d7a
SHA1 08bd393a99256a1f7d1a54c21eabaa3bfbe6a2e6
SHA512 c7c2d911b32dbfe4a9ec03f12934ea6edea0710f77bf7d352c1b1aea29166f8a0d0c694e412eae2619ba816981a1d7050bfcac381e3365bad4d720ed36b08f47
SSDEEP 24576:PyYoANbh1do7RLYBJ6rNyufoN/ZJcg0+KJq:PthBh1dYLCJAYufopwJa
TLSH
T1B0958160A8D3FBAD71A827456A792A62CBF31441C6F7B9FD521289B972C00317F1D0BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UgAa.exe

Path C:\Windows\UgAa.exe
Size 2.1MB
SHA256 8218aa5fd88e647058b9e94ce7811cc542feb074dd93e5936e4437d944dfd82b
MD5 06414c6208f649c162aca3cd8ab181b7
SHA1 3bcc5f9e550508a1534e5b48ed4122e49e2a72d8
SHA512 aae9447ff20f5849d3e64d2ccdc23eb7a39dd5b07244e79e710f974a969b40f08aac8a21d66f6d398449098c1da6fd0a27bc2a99413b573b5d57efcfa5c969e5
SSDEEP 49152:Tg0OQYMBzhEDdlMLUDyM3v53QB/RtlcV:FOYzhEDdlMoDyAlm/blG
TLSH
T176A56327C6335CCD5C3A1F6A97B353ADB236E6DDE6AA4C4DD5E85800C032C4B219C99B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UgMy.exe

Path C:\Windows\UgMy.exe
Size 1.6MB
SHA256 6749f17c28257964517b097c816632831540d6b2d5eb5fa20b932fd053e6cff2
MD5 43f2c3cd3a4a5aa6fd0484e412e17284
SHA1 81e3ab80ef1ec77b1e0c628bd4b6d4780df22acf
SHA512 5ab72cbd3560ea72295075e5efff06fb3bd2b331703cd2e055f7dab76ccf42176c2342cc0769e164f03ba5ac4bc512589fee248fb30a6a3c216cc89f0160f2b7
SSDEEP 12288:DL07fPVAsWA3YpR4jOBc8IwYJlHkciw0UnowswK9SsjX9Q9ewRBMdhoKodu5iu62:DkewRB2hfo0wRbvpYxd1J
TLSH
T19175FA585F182F80F7F80F5E28F7E8BF586BA1F255694D884207E543299D9C0CB62AD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uowe.exe

Path C:\Windows\Uowe.exe
Size 1.6MB
SHA256 adf17a8e58caa03c1fbb89ed5be2ec9b72a17e25f50cbaeb8234c6ddb4842a8b
MD5 f0df08ac82e88d293521a686aea05d41
SHA1 924c60ea4cef6389b1673471df12c94d667f79bd
SHA512 872aed43d6140e1fc11e5f9b59a833da29cddcdb16d01f7835cffbe585ba82ab2e49123e01e92097d47f80ae65ab795bf8472b3b72b7bb3d9007510bc7b061d9
SSDEEP 12288:iA1t/bT1LEPOZnXZy6mjpc3DsNW1YVvwHqcQrWzLDzPcAg4BMR2+50DtYgGCyRfd:r1t2czFCwKcKWzLDzPc0EtPwNT5iR
TLSH
T1DA758825E0439D935B68B7CB88C6B3DEF18D71E829FFC9729182C60D1DE20AE171956C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UwYS.exe

Path C:\Windows\UwYS.exe
Size 1.9MB
SHA256 d17f142bfd3367e591add2f9f707582e7ee86d4ce50cf83035e0c35bc17689c0
MD5 923c7cfdac0cbebfe5abfc1f3d362008
SHA1 72d8815e5be191dcb236e9addaace90c32669c38
SHA512 a7bfe210e39f8b945722d92f57ff4cdb5312b1c042dd6c30949b88e5e5f81c248a533d14e2f5f672634baa1706875f56c549c593b4b72aa29a972886750e7fc2
SSDEEP 24576:5AAAYAAAgrv7//bJS+sPw7nK7fji6vJla7TcLlFiHBTmoq+G:RXbJDsP2nYfj78cJWG+G
TLSH
T1F395A78CF945B4A998AC8033C5C94A0820B501D6BB145D6A9E341FD7BE0A377BD9FF4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WAYi.exe

Path C:\Windows\WAYi.exe
Size 2.0MB
SHA256 991ce90bc8fbe3dea2ab368912b3903ab3422eeeae4482f3eca44337c47e7716
MD5 debd0ff6314ee87be5dc2e916c510a74
SHA1 e1b0ce3effe8840d2803f0bfe79129a82c003dde
SHA512 9a15900699ff7bb24f84cfe75aa849219932e1530c0c229bf5fc959f306416036063a9dbd40e809321bf465442aa23a30b5ad6bba1a2472aef73160499327f15
SSDEEP 24576:dmymPvtKFkQI3XOirb8kOZAnZkaDyg1HfHaOM2g9z6VCGh24E6YhvIXEU8:dWPSkQI3XOir1wDwP/pMu5ChU
TLSH
T11CA51D1F7E4BA3AD892648FBD61082FB852293FED829A34D2501C3D7652B1FD4C9709D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WKMI.ico

Path C:\Windows\WKMI.ico
Size 4KB
SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
MD5 ac4b56cc5c5e71c3bb226181418fd891
SHA1 e62149df7a7d31a7777cae68822e4d0eaba2199d
SHA512 a8136ef9245c8a03a155d831ed9b9d5b126f160cdf3da3214850305d726d5d511145e0c83b817ca1ac7b10abccb47729624867d48fede0c46da06f4ac50cf998
SSDEEP 24:su1Flj/XygwYAaMiM1E2/pkQ14btLH3RJigg1Kjq:vFlj/XygFA28BRkI4btLHhJigg1Kjq
TLSH
T1579127351B08C4E4EC5AA53182A706F708AD2CC3D1B4D47B52F07D7EAF33B72691166A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WQgM.exe

Path C:\Windows\WQgM.exe
Size 1.6MB
SHA256 874ff4a9ab0ec779298663fe1da924cde8551eb021497b86d34b8ccfadad6993
MD5 335e79bb2cfb0c47413094f08013e540
SHA1 fb195b204ae40d449235ce2e9050c349f3e9bda2
SHA512 4f965c618766bf64a5ac05a01423890c7d9cb355a4cacbfedd0a5b9f5e44472e8fbc49c2f0269d1b77ea778bd2a9db26e619a34f7fe53d23057ef6e8b27c3a21
SSDEEP 12288:Q4ocznKi6OiuapdBjodIBV54xG6ll0d5VJFOoIHDxTt:QvcDKi2uSyx7qdRZIHZ
TLSH
T16E759A7307823860B22582466726ED5FAC278DDE46527F971C02E43DBE4E8AF7D0BB45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WUUC.exe

Path C:\Windows\WUUC.exe
Size 1.6MB
SHA256 7fcde49693b2688602946f0a4dc24ed1dd5038d86d2dc3174999cc1a93801548
MD5 13083fc222f7df01b6235108c30c6300
SHA1 8275335342c4c9330658c95aad7179cc464a45b0
SHA512 b4100ff3b1a71e117aa3ad1d6ab475e6cb0303c7edba4463e653652345b8b4ac76929a6d8a762b28a25d9ff0cf8cef7f2b0da69c854b4eec771511a8b903871a
SSDEEP 12288:YACIKok0nYO+7UIBy77FqgTS6L7WVzo3XYMDKvn/7VK8M1Fi3p3:pCIKoYHBy7ptTvioBDKv/IWp3
TLSH
T17C75CC1B0E97003D8BCFCC6033EACAD4BDAA63DC01D0E4F59A59B45BA1B39B947B4594
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WYsK.exe

Path C:\Windows\WYsK.exe
Size 2.0MB
SHA256 c7029cf7d5a6363d3a6b039443192e79d317119382ea12e7d8bea45eddeaa9ba
MD5 4182183169edc02cdad6fc81a3caab9e
SHA1 a7d722c859487bc726f8dec5471c819bdab524fb
SHA512 7cbdfa02776ee46741768133c0af0598a5cabfe0bde14b6f1103543e4837f2e57739e37aea92f9fdb5f0ee42d3596201987eba74fcc023fb510fc670f61ece68
SSDEEP 24576:eO0UIdF9e7r2+RUvDg3vnuchz36YQxGMdGuhdevs4H/C9:AUIFePxoKvnucJ36vGMdGGes4Ha
TLSH
T1F5A50EBF68DBF52993FD66B829A90D669CE48DB1D206B7353536F018C24C8EC21CD4C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WssA.exe

Path C:\Windows\WssA.exe
Size 1.6MB
SHA256 c60bab74b795146207402a4ba8c0bb5196ee17d93452efaa3b8db6fe7fcac592
MD5 5a89a49a716d3988a02a091ff44733fb
SHA1 2a644be9b26db81b63e4905c0076187b0dc65153
SHA512 a36f5f625f0b2e8152e2f1192f018191afb9e32387d5349f9ae4948c32f1bffea6c7f78270e118fc0df3db906e7749478dab55e112f6cfd53d7d8da303f650c9
SSDEEP 24576:FNwbB8vSuVuV3UPOND3+jZD62BMdqnfPVHiLI0H4:FN4zuVuVkPl62B8qfPVCLl
TLSH
T1BA7587196FAE4E3FB3F123F69B0DD17A631DFC31584C2566916BA8E0254CFA9206907C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YEkM.exe

Path C:\Windows\YEkM.exe
Size 2.6MB
SHA256 8cb721b794e5934451c6f07af70de82e652d9702dbf31b5a96c409d394205c50
MD5 5b5ed7b1e97890f64ffe2a89e6bb5330
SHA1 4aecdd66b8e7dc8347974158c348e538370e707b
SHA512 4e528714330075741fba6789d1dc5cddfafd6d6f64598d786b72c3c22f48bbd4777629bbddb832dc228e22c47448806ff21a86db106f813a83a8cb0ee0613cac
SSDEEP 49152:X8DQ4hTnGojDrIua9dQ9yv1oYjtRCEkvCUO:jCWyQOEaCUO
TLSH
T1E0D52E3383A45765BB2D04A9DDDE18CBC3767DE60086D698F92484DB330A35E8B79B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YIYI.exe

Path C:\Windows\YIYI.exe
Size 1.6MB
SHA256 2479c1d0589b11a10854c871f16ef30e51663b676eb5a7855c70c511dea747b2
MD5 c8e19a94a475fc6527ea8f97a690e523
SHA1 9e377a03c07a07b5fd2a610f028a146a97dd7a74
SHA512 4f4ee03bab8ae30bde6aa0da0668ba99a555f87b262a40bfae02b359df0b72e0f5d66bc68505f0ae45962dbcb17d381389c9c82e9f73a9ca0b073aa6abe88133
SSDEEP 24576:rGV89WYggFKqDZMcKKkAMCJCsDajYVMvF1l:CV89WYX77cCJuP
TLSH
T1D3756972CDA128584439A0F6D250F07FE5773B9EE643E2BC6E38E1402661B9F5046BF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YcAi.exe

Path C:\Windows\YcAi.exe
Size 2.0MB
SHA256 44ba4d47455cf4e50cb2f2a049b142f76aa2277d38e9f17055b5de67fca1f643
MD5 28da05529fbbe6bdc50826182742b3d6
SHA1 a6ca7f119e3e8b6694d5073701aae5b472bd800d
SHA512 97f5451e8abb6e35f22424917e770c1717cec7635e7086fbb12f27eab608e381d185989724d9692bd6c9934839d2cfd77da125b471e7b5365549b6d89895a154
SSDEEP 49152:AvDM0IijQY3kG/HH6FTIsI51MV0Ybzi8D:Ww0IY9HH6FkHAV0Yq
TLSH
T17AA53F9C643DF7DB690890AFBF1218A85483B8FDD40FE6DD27820C9781B6B894B46DD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Yqsg.ico

Path C:\Windows\Yqsg.ico
Size 4KB
SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
MD5 2fb613374fd9eef57a03c8a2d2e52d8e
SHA1 345eae2c0189099b5367e22315b663fe6d037232
SHA512 74ed79d3db6211b1bbec4ca6003fecc866d84abb38987fe4a442558a520490797bf0b54c643b6b4bfc687b3be56d011e204d89166cad33174df82a86fb036f99
SSDEEP 96:xguRJDhHREoYxoJooz1oj8vJBI+L6Y1X4Ni:xgZb+Hz1FaI
TLSH
T14291E5E8D341C55FE0E98B77C2360C77E2ABDC6E8A79896E024C31D27E31643196690B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YsIu.exe

Path C:\Windows\YsIu.exe
Size 1.7MB
SHA256 3b5631989cea98d576d7f662668a1a7508c3fe026e2955b47a668c42f6c3cf88
MD5 7c6a5587605277dd582c0e9329b8db2b
SHA1 49e651da935a461b3e9aa9a1f2239a682a50ab60
SHA512 1633630074da49167845475a93b56fd47b8d607014e433facd1da3cc139ac144d5688a84cc077da119c0e59207e713ec1360901223b4f89fe47a9a7c456ccbe0
SSDEEP 24576:yumKjNG2XLfl4TYsufJUVNSkrb/5ZzRZ9e:RmKhjt4HufJs3/5ZzRL
TLSH
T11D851E5EA050436E442CCC8705DF0F7042C862E6BAFF996BC67CF39506A998E5B75CCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YwcE.exe

Path C:\Windows\YwcE.exe
Size 2.1MB
SHA256 47fca62f7e9ac85563b16b19fd8ce0f239491899f79e2aa721eba5ec3be14bfb
MD5 874d67f35c30fa6c0bcd29ef590133da
SHA1 592a46aa037b9d9dbc67e1720dc509dd4534f21b
SHA512 8c2d71cb969dfc03f126cd05e54e4213b0932b51c33cf998e2860493738c91aece88f0b9eba6cb5f06066aff2c25a1d8f3fa1671e754339a74a3176f39421e8e
SSDEEP 49152:YAO9CoQ2gM1N/SEUqIg8+AcNtlyAo8sKAsiiXVaoud3V:JOH8+4eAA9sSiCIl
TLSH
T13EA55FC7743C8FF0A847CC7B86C46815F3847BDCA55BE0563A8EFD42A6C1526998C92E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aEsC.exe

Path C:\Windows\aEsC.exe
Size 1.9MB
SHA256 b9692831773706407bf84e1765640ff337c4c91c9f833b2a63bed6f866d48a3f
MD5 48269636f5667c1e31edaf2b3666b0a4
SHA1 3e0bf160163e1f8b91e6baab9d08312a107bd71d
SHA512 fd15952dc4339b2167287d3899c5fad184999ab0de9ffbc018c4d298d31893fd8a9cb73d6d1bbe198438928d6350d157e2794f71ec9ba0ddbcc62799147ac692
SSDEEP 24576:yO4oyJvk/7qyHC6aFVg/f3vctZKMGrFUfPrp635nicLruY:yxD8/myHC6Lf3vcLbk8psicH1
TLSH
T14295C87A299B09B1344377783546D53DB468DB23FC27888B93543457CBA68A323CEEB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agUG.exe

Path C:\Windows\agUG.exe
Size 1.9MB
SHA256 7bd357b324195ca2c9c145997259c1b4513a09113e0a5922bce86bf968f1c492
MD5 5047194e2099f4e662c2be9fb41e4375
SHA1 4a30c1354bfa979907e0453c0becd667864896ab
SHA512 fabc3f22ef97f6eaa1aef0964202277eaa4beb7b90474d5fd2639e459e68a9b4aab43b69ee04b97b2983794a59a36ba1e21b14132ba9cb790897284508e44b23
SSDEEP 12288:dHxhhv46OUHwIds2Gix1EfLU5ZFXavMpcQzGs9F24UTI+wgHdaI6TbiIN68jyeyB:MvJUvE8VpcsrXngHYN9GNdxy0htK
TLSH
T1FA95F977B1CF996EE0F456D4423AE92848D10620367F6FC02CB11FE4299F84DD8DAA67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

awIw.exe

Path C:\Windows\awIw.exe
Size 1.8MB
SHA256 a0cf538f36f439e9a929ee402b26995a99fd0433d73dec6ec41c3ed226f624b0
MD5 0d2224e3485306f2bb9b189c06452d4a
SHA1 20eedb27bd967af773093974fceb51c636fb9a9e
SHA512 232b642aba6fa7bdecf3021988a2e42fe634e7a4fdf2d251ce672d352898d91a57d4aa27ab274469f365c793cff659fcbd1c2b3312554da9d2edb27430d6dbf3
SSDEEP 24576:3p75K77vR9jX7/fv1vbtX/xvVf33UXxmbaxMZ4WSt7l2:575K77v3jnJzvVmx2e+
TLSH
T1C5952B6BD6A3BB95F5EF4F680A110951D23BAF87A40E21343B7FF6594B214C2D088DB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cIcs.exe

Path C:\Windows\cIcs.exe
Size 2.1MB
SHA256 45e876962387d0cee9c55ff66731edd2a20075645ec4a4293facae8b7821b851
MD5 cc33396575c5796bc2f601b8b86d9b64
SHA1 79cdf8f89f4fa1dc7a5f51f36fc38ad1b145784a
SHA512 70f62045635482db55180039ab52ebfc720872e61f3c7ca6df095ce22b7f6fdc11af81c41cb72d2605b91864d5188132650e1573fdc445ecf490a22e7902c239
SSDEEP 24576:AM39adaWethkb3X52EPwMVRw1oeU3/XYhqZddsq7X59R1K1xd7ghNd1t8:NaIrkDXAwVW1oei/PkqTZ1K1/4jg
TLSH
T114A5E92DCB0C5AFBC961E4E2CEF0E5D013D448A92B349E568CDDB7961D66766C38382C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cUck.exe

Path C:\Windows\cUck.exe
Size 2.2MB
SHA256 34364d8b18f1054020c1cacca06934602444ea900c79fc4f3b5cb7c6a290a2f2
MD5 77ed81f97f43b1d6d66bbb3fec425405
SHA1 f45688fab7e1c7838ec0c50176a17e9c84b66817
SHA512 0703c4a6c0a8fe3714f32b2007dd08cad590ea13195c00269edbf2befb8e27dba6aca765fbae2f77f086275326ff0922c869f16907fb1dd8e6dd96263b18cae6
SSDEEP 24576:xaz3dws3DxYMP2VxNNdJPdfin8vLY40Y0wVaquEIuoSrGS83Wg6z+szF1:kZwkfMxNhlYhkQEIuPrZ83Wg6z+Y
TLSH
T1E5B52D791028F3B18C9B0B3F1B0ACFB0CF21655AE5D8E0454DE6D5C86E7D5BA25A02DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cgEy.exe

Path C:\Windows\cgEy.exe
Size 2.4MB
SHA256 88dd6b0d053d5dfc9ac193577156d632eea6de1586bd4a2a523dfe319deda036
MD5 cdb5e43972286cddeb0e4bba44fca177
SHA1 c1b87e082a19e17306195cfeb9ce4f14414c581b
SHA512 9fe382b511c9ec6533d206c72582614a3046aae4c3ff91efc28761a181dc337b78977c5345de944a12db32cc6d262c56c45438ebad1d7dc29c8c896747b4b1ae
SSDEEP 49152:qDcfpA2Loa87OJucemr9qwwQKXZrdPyWtFDtmSm+LrpyjtwVQEYA7+A0dWtt9XfO:qDntN+ZQrXIP
TLSH
T1E1C5538A5005B3360C3F465C2026F47ACBA853DA48A77BB52C7FBAED6114B0D16C7F96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ckAq.exe

Path C:\Windows\ckAq.exe
Size 2.4MB
SHA256 2fa3c712e1e0c5cc3dc6542e8a9882e813a42357f56259830f937d0876be4b86
MD5 bee919896a5ac7799f9226c4a112e331
SHA1 0a028119212b0f6eeca6985c4e41b438a6aeef17
SHA512 8bd768ace63dcc041b603727091631068718b08e9f582303c3eab8a35b07ef320b6802e56daf70fc207b15b80322e1d2dc828c4f49fcbff0d1f17e43414bbd5e
SSDEEP 24576:ARV4CiJ4U8Y7LImClYz0IlWe3Psy87SD/wS/c2hP1rLq1tZG4aEJGjQU:AL4N6LdmhAMWe3PT1D/1/9jC/xaEJGj
TLSH
T15AC58283058F574FDFC7B574ABEFA5A8E71661CC19AC1A1D4A037CB6D84082BD84C6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csYc.exe

Path C:\Windows\csYc.exe
Size 2.1MB
SHA256 6af1d69c960aa1a18b002936a38c040a2c2bed99e56377604273b5e6c87e1076
MD5 16da47c59fc67c242b2edfc4b9c6ab6e
SHA1 a954c6baaf35f156f186501ad8e32f63b6e3f87a
SHA512 5769ffe7caeb39d2260103b77e6a51fbb2004b2e4e45d7dfa48cfcdb9cb7177630ddf30fe01078503ed620d16d3566261095c98a1d5d247b4fd987ac76e1b117
SSDEEP 24576:/E8NrIoPS219MS0DGIt6oB7gitvx0Owro8SHrIzT6Qr4a4pG1ndC6W:/E8KoPS2f/C6mciAOwk8SOgQvW
TLSH
T131A5304F48A6E9EDFAB101B76F1330B4E76448A8FD957033029B51ED0DAE53D49822B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwsC.exe

Path C:\Windows\cwsC.exe
Size 1.9MB
SHA256 874edf5bcbf8c99315609c6afd63f8fdf7999e68fa927e8fa6a6f7e45da0029b
MD5 0b43cc920a2989dbbd235dae04a27275
SHA1 ddf744a5941d4a9885db79315eaac404e09e3857
SHA512 8ad356192232e246c77684875aab358cc64402c5aea40e53e46181a3ab4073529771085bcd1150cba88154d568e3691098fe7fbafa81431d620d986e3d59fa7f
SSDEEP 24576:ni1ebHA8T+qWo+JZk1fTjNStbS96ZO19tBMQ0j1H8v:ni1ebHAo+a+vm8bXO19tHv
TLSH
T1B795FEF952F4EF4215459193304A9DE831187EE380C985CA79FDC85AB3B82F316DA8DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwsa.exe

Path C:\Windows\cwsa.exe
Size 2.0MB
SHA256 7ef959a361d919cbe70c11737c40f206c65a7ab2bed0a8f28b9ab50db244d640
MD5 c3a9d242baf80e453862953545f6ce58
SHA1 018c0a13eea5cb994a3f3619b10449ddf54c9c63
SHA512 ae765eeb52f4c0b93142b6324d638d3a6476d3537b735cf5d8015a0aa0c01a0be16393b0278dc848f46e242174bcdee233bb5ece456b710917fe17ef0d479107
SSDEEP 24576:JeIh8Kxip720MDH+r31t9/LzuAbkVEKs5+j1eMoC1ZZKcxYLzGd39dZYN4GR8YqO:Je/Kxip70er3Rwr31nKoYLzGd8s0/sH
TLSH
T16AA5FCACEF5CB65AD709DBBCAD1EFF53199AB40B02812A7CA434A77F40C83C5D6A0505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwwq.exe

Path C:\Windows\cwwq.exe
Size 2.2MB
SHA256 ff1cbe82f617ad75d063a54c39cff8d5a231ff71025671caeeb4028f2ea7505e
MD5 50230a94a441a0e79d967f5bbb185a69
SHA1 a2fa5f3caa2681e77cba65e1a1b19491a138ff3c
SHA512 2d9262f175d08320483990aa4127bd148d8e5aef98c75424028157bbfcf0f50bd1d9b3f2727e1201777cc1d776b9971b9774a4b19bcb4cdb1290cc53afdf31c9
SSDEEP 24576:Q/THZIr66kUVghEmhdNqhnNILLtYp5oreq8b2x:Y2PVghn4hWKp5orehbS
TLSH
T18BA550D4DAD6C8B9F49F913C9D8CE92AA65D7C501732B906A81A32DCFA0541C7CC8FB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eEok.exe

Path C:\Windows\eEok.exe
Size 1.8MB
SHA256 12b374d04fcc9c1826831ee8a13a96a83123b53fe84886d1a2944f8d3d762766
MD5 39bc6c071ed2a67d93cf418b414808e0
SHA1 50799e82b332d06adfef8d8f4335da117c497f93
SHA512 51f2a2fc28cc53a0b4724b75ce64e05fdbf2df08e08304f48e2b721633807ff77d4970625160e32033f97e425fdea98c949a2c38d7bf05cea59aed1f17fe6ac2
SSDEEP 24576:qWI/y+YDhnWaicf3aUaRBLEx9rPzONgrEdWqwqyuXQMRRO:qWt1W8aUaUx9raGEdzwqyTMRR
TLSH
T1B3850EA7234D341DC1EB60ECAC8A779DC16D7961FAFA44E07440A8973EFCB72141897A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eMAU.exe

Path C:\Windows\eMAU.exe
Size 1.9MB
SHA256 80437f491ae947db6453a8c40f46c321f7b1d351afc19c9a57fe67c02d47352b
MD5 c2cecd2c7445e755084e0b2f29fa7bd6
SHA1 d5f6a83074b52f83eefd0c574485a01e560345de
SHA512 a7a74154dd43b798d03c52e1075635709ffc723057a38f04081b8798be1167f791cab2b1f66a0e2c10d50ffb92cb29af6f7389674e838515bb022f274b896250
SSDEEP 24576:z3lmBo2CraKJ7FZ4p8d8vFnIOFwdf/6uoB:ZH1raG7FZ4p8d89nIG6f/6uoB
TLSH
T10C95B874F7C3F801DBEC84152F125BEEE6E6C30219B19FA1118A5F5BAEB4A1478D0A35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eQMm.exe

Path C:\Windows\eQMm.exe
Size 1.6MB
SHA256 7cb3d92be8dd1d69c6e656ec93e4c67dca25dddaa9a306cb323164d80aae8205
MD5 3d62afb987b4852a675dedc5af6bfc3a
SHA1 70107e538282df25d41270e64706b6790f62572d
SHA512 254494404141779f004423c56dc969a7351c366283f6f0356dafb11efdd0db107b47b795704d76f80ff795217d73cc919debaa9c461e05ed9e1612113fef22e1
SSDEEP 12288:E5z6uEhuWsLv7Vi/BYw3joH2uma6Ur+M5Rqv5DwI+9LTMcjW762aEo:E15LTQ/BYY8H2s6AvwDn3T
TLSH
T1907586790E202E918F554157BC4E25BC09BDB00B2B59FE99D048E9C044BA97DB3B6CBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eYIW.exe

Path C:\Windows\eYIW.exe
Size 1.7MB
SHA256 82825e9b3afe47216f9c877a7e322259339188467a07fc7aed1d4edda074f132
MD5 f76da8259ae540e4d1b3ca0a594fcc2f
SHA1 ac003e2915af2667de82d9d860e8dfb3cd51e7ad
SHA512 73e8cbc78454b1a91ac5e2d537b50b236efcb985c535881a997a5f2e2cc51245816aa2a8b779e46f7b8aae7a1045c9b63df8469a479fd79978fd3d044d138011
SSDEEP 49152:O5s6eP2DhLLpPXPLOve3sAjcnr3x42tKwk:OnDL8evYr3x42tKwk
TLSH
T1E8851444EB0DF797F351F5C968053809FAE0A2EB5CA6609EDDFF587432EDAE82252101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eYIe.exe

Path C:\Windows\eYIe.exe
Size 2.1MB
SHA256 9c06161e0a3ea4758fbcdea627100a89ae4a66cb6583a8b35424d3a5390c7a77
MD5 b0c0c130fb0c0d04fe578a6cf59dedce
SHA1 9072e08b70fc823314c9e60f7c51ae90b38b9dac
SHA512 5c6b71186740fe0e7c37beec48b1745083e1e9fa05f3b0c8e442a5fa563ea355a93db31e8ba8cc7be234d5a9c9d41573f127155ab7847d53b0827210816c8909
SSDEEP 24576:9MjTtI7RZFev+3lODNhhaI7gFBAN7g2LNSpFnmG+vg76qHz:ej5Ij8Ytr2xSbnmG5T
TLSH
T155A587D28139F676023DC591E8918F08E9CC3F0D1B17A1EE611284C66BB55EADDEF1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecEQ.exe

Path C:\Windows\ecEQ.exe
Size 2.1MB
SHA256 9d6b7e861ee16d9ccf096c3aef2188745e702eb9580ee6cd69a35100157a9f6d
MD5 5eec7cc56dd6c4b62a360411e7cd7c70
SHA1 3036bd275c6538e5c2ec97a55d4f92f5b486cb0c
SHA512 5e02adc0f788182d83350dda951d2e3f4eeebc39ef3dd616710e1aa8c7ef9773241f069fd826d6f3003d17b03aa5361cb98d2a4b59112a48e80f4939f74ec65f
SSDEEP 24576:Xqo8KxRYAxhJW6FzGg4fr9VVqylLY4QFUNbwTUEmRrI5d4jQ4xw/I6GaB:XqCvcQKjVVnJYDSNbwTrmRod/4e/I6
TLSH
T1F6A5A9631E9FC0E66DDA37020A5EA1B6DD5229A971C04ED407FB25F02DB0A7FD871C4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecca.exe

Path C:\Windows\ecca.exe
Size 1.6MB
SHA256 2ec16b7d996426179f9bc1dd2e6717e7128474810590c546ab1eef286901e77e
MD5 cc323fbf83aa0e2181258a2caf6571a6
SHA1 83d6343c756167f217bc65cf5ccd36f107445183
SHA512 846637154934b880156249aaf7ea771ae8278a4e0e4656f664cd63a76895e2ab4f71e1f8567bf24f88de110f21e3204d57b86ed90a0b5018e191f4f11913302b
SSDEEP 49152:79r1b80CY9YSmEgo/AcqqiVhcNApuvgAs+z7eP+jgKiUEY2D8W+21OYm0a90pcAz:79r1b80CY9YSmEgo/AcqqiVhcNApuvgL
TLSH
T1227554B11645836EE70094DB55693F9072CAC3984BEA1B1ECFF48DE83B8DD46E0119EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

esgU.exe

Path C:\Windows\esgU.exe
Size 2.0MB
SHA256 cdb27594e9833282b54e5449d8ded62b19ac6f34a2e40dd5b3584cc7098135a1
MD5 372069ae0bdcb9e410fb861eaf3a5320
SHA1 2884802bf42a37013d241f4a0bfef63b3f7616d2
SHA512 b5f856a5032c0954f9f6cee1ccf82760f076d51e45a15f2f2744cd49f6e98eff444906c49ba68b3ab2a2ed68563da951569e12af22b8d9e70531fd7d1fe47a82
SSDEEP 24576:yOjwztJyvmjrfXWdPeOGfTwzeswZtPTmUhdOM2xPsRiDN84vgZG:1xIEzesOTXdOnPsRc8d
TLSH
T13DA581820F79FE1BE744D65FE4923BB520CD1161B4CDDB34AE6D0DCD2AB093395A092A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ewQY.exe

Path C:\Windows\ewQY.exe
Size 1.6MB
SHA256 42e7977eab62386e7481c592bbe841485e35f6f5bb449f6d94fb7d020e529696
MD5 c4a8632daa00758a7773d9fac3fdb8f7
SHA1 709d86bdac3b1d69f9a0a9c57f62d7135d26db4e
SHA512 8613700e853d2f42bce226d1670eaf0b1f3d41241aaf7f569f96a4f21db680350f93171237170ab72f7ec5b873aa80da182c15ece61eb9102640aba634182601
SSDEEP 24576:Wqgzjo8ajy+ozFSY9D3IiefFc0wZLTQYJtWS:WbzKozFnJ0wZLsYJtW
TLSH
T157752EE62DC5B82D7C2762FA7104D83450DBC438A38A550643E54DF98ADAB847BAFF07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ewgI.exe

Path C:\Windows\ewgI.exe
Size 1.6MB
SHA256 c3099a8f90024e5ff7b5e672d4d1c48ed23740f5730de6bb135309b17c0400f8
MD5 53f072444eef027fe68acdb6994534fa
SHA1 82129ae23988d6c328878db5a90004fdb0b4eee1
SHA512 18c27913840c0380fc0e3d516337dcf5044dc224a8660a9654d7c320b4221b2e6ceab5fdec0f65a778442d88a0366bbaf8d026c41fe7c08607872075151435a8
SSDEEP 24576:P4mN+sCvizB4Xs9fbFVEKh4AcpM/w3nsXWKw+hi://zO89fbHzdM3neWKw+h
TLSH
T1CC75BCEFE078B8C4657FE8D8645C8A478BD12226F21F861CF06627A1050F07A5E67DDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ewgo.exe

Path C:\Windows\ewgo.exe
Size 1.6MB
SHA256 b6012a6d07275b7e9bf752681aa7dd2d8a001f2d0b3343d74b52ec6c52b391e9
MD5 fd49f7f7cbe7d0d0c1c19be14f58e475
SHA1 bdeed6bf1acb0b561c8ade40ec8052d3c26da97a
SHA512 f1ca1969f939a1ff33eccbf10f20835241306e11b0440f19d3004458ac981a3a927324aff84fe4bf9bd9dcef975444655f5e077b8bcacc996336b80cabdc0688
SSDEEP 24576:ZKqpzx6ABzEr7nrrkrr87rryrr3rrArw5oprgYbVrYrCrMrjr/rgeq+5qORfMZxx:pq8tUqOuut
TLSH
T12675F24D30004CAEE4B3C7DE2CF6E6B23068F36E1619F4FD19295BB5593C19CAC59A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gAAe.exe

Path C:\Windows\gAAe.exe
Size 3.0MB
SHA256 4d8c9e3ab082e41c3781fb8e7b7790dfcb7f74316b13abef853ba17555da4c4c
MD5 f3718f0a56bd755309722a347d8fdf5f
SHA1 8a3b749a661b04760a2c42774e2fa2b0febb13b6
SHA512 79889ad9cf437984ea3cfb7b6cdcb576e1889d1f635882d57850f2811e0e39d262afb859122847af4440a7aa2c95645f83e01d97e418cd267591fd4d09bc8413
SSDEEP 98304:DHh0JeKgmk4VTKGf5ELyfvu8VAn56PLB:DH7Kgmk4VTFf5ELUdyiLB
TLSH
T158E5C36259670FFD7E118B32C790B7B60C70B1202758C39FBA25B3C5487AD1E168AE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gEcw.exe

Path C:\Windows\gEcw.exe
Size 1.6MB
SHA256 069098dc7b4bb17b0d94525e3d1d55529e3ef7fd7355cf0effdd99d5c269fe1c
MD5 674889638b60419d2dad2eb40d591eb8
SHA1 b6cbef7de06099e3f27ea2631764c07972d50685
SHA512 a3f02b7b3556e02972bb4d77429cae46c775c116c5b92c9bea29bf79404c77d88971b9a702ed59ecf8f90a49378bf5e69b183a3066fbc36396697af0fffae2ff
SSDEEP 12288:+rWVYJTm4Ae2gnPkka72RGlrQcTmYPMjz7+BvFS93/Horo1rumNk:+Cy44AL6k32RGjdkH7+BM93/HoshfN
TLSH
T12875BA8D05E5A3E5B19C74620A0ED00E6931F7D64E1A90FB225B741E9CFC7B2FD9C922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gMYG.exe

Path C:\Windows\gMYG.exe
Size 2.5MB
SHA256 7fca3d115da41c43f1bc8a90407dd8bf893b393850a1abed69eec732eec02852
MD5 f9d7095ca6fe8505ea9c8e1ee6714f17
SHA1 b12bbbb7130c739b311a4b3e43fc4ae7f7efa7f0
SHA512 d40193d496d06fa947680e560744d76ee6765bf8e1da359bd615026c938d7590b1f80ea543c94d7ef8c960f09131a3da9faeb513d028bd1a3ee3b986a574db33
SSDEEP 49152:aw503D3yGuGGGGGGGGGGnGGGGGGGGGGN3GGGGGGGdGGGGGGPGGGnGGGGGGGGVGGm:t6zSna5nYlrmuecrtL+
TLSH
T163C57012D06772E89F66B9495FBA10EFA1FA5C481F9398D041BF0E7B894DCE0D26D438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gMYS.exe

Path C:\Windows\gMYS.exe
Size 2.1MB
SHA256 f042cd627c16ea5086071cd44eb36afca9248eb78e1fa438e9cc9a3824c5872a
MD5 b236575713b3106939653db9f6b8cb3a
SHA1 00d22750397897ed7a8fe41e0390ad2b05be03ce
SHA512 e6fe2308c6f2324989dbd12beadc3b81fc0083c2a754917d5ea51e8a9ea94548f91e15877d632733a63ba71d4ebaa94049dc581b96de4120f73f7b953e9e8509
SSDEEP 49152:pCHj8xSVZqiHo2Tx26ccApBscCUxzchRi:QZpHo2TALc6BsTri
TLSH
T1F5A52AADD223761359497683AF00A76047D9439E96EF0B3EFE25B43D08E0A25373DD89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gsgo.exe

Path C:\Windows\gsgo.exe
Size 1.6MB
SHA256 89ca8a5d3934bbd5a5db028769746eab7205c160a4b831f45c4a59590552ec26
MD5 7b27027ee14961162d43aa153c70d361
SHA1 2bb12633f9694d40249e12d66ab920b3c2603f3c
SHA512 b05f4351e8079051f5ab8890d687838f6e5fd94b6d1c0752654af2cf21d5fc84c11044346c011ee4adfbb63bf704f2925f27057447e3f494d07283baef0113ed
SSDEEP 12288:lKi81z1T6YN/WGUogLNKq8s4SLumvBK0pv0FlwRRVXbjos5jvw2PzB21ldf7xqnz:YoDQgmQPlgf+mZtSLtn35
TLSH
T1EF75BA5B44F8BADF42092AAE42C06717025B0A15059787E897E596EBE60FCCCC5D3FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gwws.exe

Path C:\Windows\gwws.exe
Size 1.8MB
SHA256 1f9de22ffacea887b267b42ad5f43c5a562ee83c390f3b80c8d66f6cfc0f85b3
MD5 415131c5f0a2873f7fa09b9c4129afc2
SHA1 c8158697add6daff67153030c57ac7ce06d5ec22
SHA512 2d704b2a63bba6fb4f9a0b03c66a25bee017cd2523fd0dbaa6bb24428f47fd89ebe125d5eade6abb34333d81cd1fe9d875988d48568b433bb3002b9a8e01ff17
SSDEEP 24576:9lNe2cyIwlhg7ZARg/+de2qj0RKmNTdHoOJPMUD1FZM9fD:ayRgKRg/+8dj0MmNTdHoOJLD3ZM9b
TLSH
T1A3958401E33C6B1CB7C15B6532973DCF72ABA5D88B3885E60C854AD2818E5FFBE46911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gyog.ico

Path C:\Windows\gyog.ico
Size 4KB
SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
MD5 743bdd687434129391fd0c5c75f33ef3
SHA1 ab0696c2d38531ae88707df5c6f5e21cb8591a1c
SHA512 8b1a87f915c6ced6071cdf4a533ebd5caa93197687946dfaf8fa0d28c358f38b1b1e232329ff7ff73950d7d808290214cc1b7114ba97374a92fc5fd0ebbe585d
SSDEEP 96:tzwwwwwATlRCDCkiZi8C6CbqHTTejtjmjFj+RIW:hTlRCDCkiZi8C6CbqHTTE
TLSH
T176911A3723595C35FE514DF0BC9A9A9CE088BE5483C22D9427EDF99EB47D8C209FA850
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iIUQ.exe

Path C:\Windows\iIUQ.exe
Size 1.9MB
SHA256 7745acee3216b7ef30c23ed41fd9c098b8ec2800ae83cc7fbe1aa9095d4661de
MD5 af2938998a775fa918a6b741da88fae5
SHA1 e0573f6bb6424c6fb3de0a6798d3dc5a1ead479d
SHA512 e41b81571b61f1f89c1c513ed33652b5da37d18702d45d212d8bfa717c0d56c895b864e68d811d67c003a8c038237cdd83d88407ee6cfb2f4e021e1225f0087d
SSDEEP 24576:R2FDUDi59/aS82SnJLUmC+EL791ErzyWcfkYSL:RuDUm50S9StUmC+EL7bOeVK
TLSH
T1289570CF541F6CCD3EAC9AA736560F3342BCD8A0140A264DD895F7CD4FE9869EC46922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icMc.ico

Path C:\Windows\icMc.ico
Size 4KB
SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
MD5 6e9325e46193ec554308cdb9ec8a9cd5
SHA1 3e3c4a52ed1fd3a85f8ab172108c8fb61e45f70c
SHA512 071ece6913f89a4b1634daa9d650bfa8f9f406719c124a3819cbdd3cb617af419abc6010283dbb510891e9744ce03cadcceea7b137395c538f42df838b1f6322
SSDEEP 96:5wwwwww6W/rQPIEXv6KvzVqzd4sJvbZwwl/j+jNj2jly9:NQrXvfzwzRu
TLSH
T1C4911623531D1CB9FD2405F1ACF89A75A59CBA0153C63C642DEEF80F69AE8C69AF2444
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iwUS.exe

Path C:\Windows\iwUS.exe
Size 1.6MB
SHA256 2fb74c4e26b7322214c51a13db9f530825a435ec775c7bcf668a23ce763c8bc8
MD5 cdeb0360c698c9e1216d1babe98041ca
SHA1 cce0d1f62e357a50078daa89ac207ca427d0365b
SHA512 2649f64be99d82da18dadff395e8421dd308c5bc8ed0ec01ee09c3f26105c5a1988de1acfdccd43a99ccd1d3f7c9329a29132b0c9e7a28ef63706fc810d38cf0
SSDEEP 24576:DFsW2UAI2IBQsSfEzHINuhMPnevjRznZI1TzY:DiW2dI1BQXWHINqMPevjRznS1n
TLSH
T13E75EFAC52D51C6C8D0E7A5CA09425A07313B9EABF1DBAC83EC633D449AF4C25DBDD21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kAAC.exe

Path C:\Windows\kAAC.exe
Size 1.6MB
SHA256 781cb56c052b524cc9fd255984eb2f8867214242789573e7849ccef412c09d4c
MD5 73c7260640878503ebb18a9a27836ad4
SHA1 068531a7df443c9ed6437324288fc5bade27ee15
SHA512 c0b0a57122ed4b1c12b420bd0095d6e52d4e7dcedbcd4634fbe33c539a9fb0e83c8e0a43e779275b77c2b6be410ec627949d55e52002cb8d57194e06b650c38e
SSDEEP 24576:vw6svvvVN6tfn1zxRLsEwjLVn5Nwn4k8XxQVihY4PLyMemxQ5b08:xsvvvVCfn1FR754k8XxQchY4P7em
TLSH
T1F975CC6CBDB65DF8488EB2D49610CFEBFC1C058462EB735BD3AE54B1068868F03A4597
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kIks.exe

Path C:\Windows\kIks.exe
Size 1.6MB
SHA256 39d89fdbe048fc2da75be88c319c17ceda063eb883c65af6e897c62105349192
MD5 77ae14d6731e532aa6d67f040de95709
SHA1 32c15a5c4036d82289cf72d411ecb3c4ad52c592
SHA512 7beda67fd37c7bed21942038da7e43a546073fe2e30c409bb507932a3ad5d6c478a15f47b2d9878a4f461cb64ea8d4174ad667526b7b20697d0d62b8c8798927
SSDEEP 12288:uNn8BomDLgCUxYOeNqtOH+9kCts9IRfG2CA18jshfxU942hwHw:uNn3m3gCyheNQbkCtzRfG2CA18An
TLSH
T1A1755387ECE02037F31C595754EEEBC6E67C51D94C9798256288006C897F0F9B2BEE68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kMYU.ico

Path C:\Windows\kMYU.ico
Size 4KB
SHA256 e1131246c60ad423586203bb8b9287e365051101ddbf532132bd47ef03ab86c8
MD5 0cc10add5cf5172bfd235c7d77f59e32
SHA1 0ef68957163b5108867fd7ef5c5a381f4af86350
SHA512 3bc12fcb5874b4dda6ba859705c2a595c4c590a85fe63ed21e54426971bf5756581ddc07b2f4154db10c42d161a5a802fc4e529cd612d5e6f2901defdf06760a
SSDEEP 24:su7zwwwwwrncNAZynBXnycjtjmjFj+RIW:tzwwwwwTwBhjtjmjFj+RIW
TLSH
T1A291F5AE538B5C34F95087F46EE5779095DAAE1B47C22D2428AFF01E527E9C139FD040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kMwU.exe

Path C:\Windows\kMwU.exe
Size 2.1MB
SHA256 4474dc9e86474a569a89113c5e37d54b82655832ef6733b412760b2bc5330e4c
MD5 8f63fba5349107c863fda3cfeccfb078
SHA1 12bf78d5cb2cc8ae4c3c52f16f5b992a9f36ca8f
SHA512 7a49e89e707d0834f0a16187055c0b52da8ad7568d946f4a9a7421171d9e6ed444fff905bb72a253a780b244a3c082c5c34619383b2b648a1c4237d916fe86f9
SSDEEP 24576:UJt0u6mWuNcWeadajkCvCDRU4eyaOxtDijWm715M+QYZ+l:Un0u6mWuNcN5jkCvCDpeyLviqmJ51Bw
TLSH
T128A5100DB04F41C6B81BB6BAD6FA98ADF10401CD148A8838B515CAE36F88D7FEDC5675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kYUU.exe

Path C:\Windows\kYUU.exe
Size 1.8MB
SHA256 83c33b9b521ddcff5d451cce0fef1a4defe2084da6893d04cdce65f8cbdd0af4
MD5 43a34692a8d76d42fcd8d63ac3594b92
SHA1 7c65a9f5b1dd5e33313b4e7595db8ac6bc95e533
SHA512 c6da4e9cc4e7e5ac6394c82e539a9fb6ca3d936fe85e113de9871e4f5edd69c150afd1f130dfb7f817d0d187a7faf6b7e84e8d6735abf7b1f57f596c9cc599c7
SSDEEP 12288:ufWlDYps7sae9/BGaocLlF16WU9efhUuxjdN9PwAo/zjis5DlJNdtGkR9wEgWyjT:ufWpYkNQCcJy18Us9Pkdlf6HTo4
TLSH
T17A9508F55CA5643680A21D42C080EF8159A7D5BF758D9E4A3F08337C8C2D664E4BFAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kcoi.exe

Path C:\Windows\kcoi.exe
Size 2.3MB
SHA256 706e62d341b8f08c3f641c3a0972ebcf479c391a435d492e9d4c1915390f5cc6
MD5 1142e07c0f9f7063d345bac12796bee5
SHA1 7f82c614b4141f880573552f232fa7ebca61531f
SHA512 ae5d5b4013ba16b78d7c23cd7bd80a56d32873536b86b028b078c034d10398a176fac1406df5749ae4038f8612e308329991e23c75cb5c6cab88fc5323dfa292
SSDEEP 49152:4CggkAtlk5v4NyhB+8ra6pONakz5XL/2E:4qkAtmvJhvraNL/
TLSH
T17BB52C0D9AD4F7622CCD8038CCA1996713E6F559C3284A743543EFAFB8B0E649D6B742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koMc.ico

Path C:\Windows\koMc.ico
Size 4KB
SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
MD5 7de70c5f9fde94ce0179324aa5720a58
SHA1 b34c69a980c52938d5b4377376adf15fad17dce6
SHA512 0b5b089bb8ae1a97e4a882f7e35c7295cb81127f0915379676590a2af296012782192381e2bf3d010f0a1c693e2eaaa2f083fd8fdd7c3191a8537b4553676ef1
SSDEEP 96:dic8fY4M1c/wHtOMreoBKc/0+ktbWrrdT+AP:dilkc6OMreSdStbSCA
TLSH
T10A91842274B416E8FA7DD977E242E0AB0E723C578B41422B71D3F7A70C710D81B0692E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kokE.exe

Path C:\Windows\kokE.exe
Size 2.0MB
SHA256 f44cffc420b73c4cb2c7cb418d8aadd2f513a0db753dff1cccec76d32106eab6
MD5 fcefea0c3c5149fb4181aca0afdd7474
SHA1 984eb380630132cf3806684b793abbfd4f13bc4c
SHA512 adf6d0f15cf46b3af620f91d9abac9f9869f214309aaa89926bcaadd77bc1df2a02e6bf708c092587415ad3ad1ac31dd2866f94462c8ebc5d54ab2239ca3181a
SSDEEP 24576:0YzXmTqobWtrqcyrGhcVM6yFwgGE86o29cppyxbKGwqjEOBAtPF/vQN33yplo4Jo:0dTqobWtrqcyy53wqjAtPBQNSmyGb
TLSH
T1D5A5217B3C416BDAAAA730CFF25CE2677A5169041D0E9256D347B1CAC8E80BD744B9F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mEwK.exe

Path C:\Windows\mEwK.exe
Size 1.9MB
SHA256 8586bc93bc1d56de17755ca93dfc67d22a9cb0ee02984a19d63425fc4e3fa346
MD5 159956e1113c01aade4b075b4d4f962a
SHA1 95ab017268082a172bd54f226361ffc8cd43c7c7
SHA512 c911fb63250b3f5121ebb97b74342bc9f6f5501a0b38fcb266d770e59a2472451b0b947ce2a0d3c45a382416d4061aec8991955ddbcdda50bc5019747c405e81
SSDEEP 24576:HbQ2+cCiGlbs6X9TXhcTfnHLUXu7AYemyQxjo7e:HbQ2+cCVlbsA9TX6TfHF7remykjqe
TLSH
T126951C77E1293E75E26243B23C3261552CBC985958B3F998D0189EB0D79FB73A1FCA01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mMwM.ico

Path C:\Windows\mMwM.ico
Size 4KB
SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
MD5 1a2d33f9fe3680b4c77b4e7e10fae125
SHA1 189a13aaccabf7608e8ac96d3f43229784398d2e
SHA512 e62171162ccf70d3e51b8c968b435308c435f8165eedcf0f1ff36816b3263a4c65049130fb3b029123cf53214c1d62fea358e39c6ef929c94d71e3baa308ae38
SSDEEP 96:xb7u41udH83HREoYxoJooz1oj8vJBI+L6Y1X4Ni:xb7ujcCb+Hz1FaI
TLSH
T1C4912CE4D345C55EE0E58B36C2374D37E1ABEC6E8A79492E024C35D3BF31283196694B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mUcY.exe

Path C:\Windows\mUcY.exe
Size 2.1MB
SHA256 91046825c16ffe5e9f0c48a5ec27d6e0b5636150833f47d5c7a7ec6d43436442
MD5 e7d5325d72170f126b1eb0b5d4702c52
SHA1 b642865238bc10312b05969cecc3556d1e394b3a
SHA512 601d267ae34da995a11f76d43682a4b6aee13c311c9c55ff563b57e8118eaa54a5b069c8558d5413c72a18791c031bf6a455f850b2fa676806095d805d87e17e
SSDEEP 24576:xHP1LHq0cBrP3gAfqC3qJHPJLDyKv2evSPAGJPoxAQfNuJe19YxBs:11NQrP37buRLnv2ESJPgfE6YU
TLSH
T199A50B690267CC9AC76AFB703FD0BB9447506E11B981567399322EDF62E4F08BC2641F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mUoS.exe

Path C:\Windows\mUoS.exe
Size 1.7MB
SHA256 fec53fef2d49e42f29421e0314293f3946952b36047681b6d1184d8715ab8e46
MD5 472c1da3336a3d30999a23f9fd903911
SHA1 79bec71cd77cd8c5cac36423536011847601d7ae
SHA512 dcbf61a6118276e5bbf4254d05afc38eaeffeb01821f82a3afd8f87177a860dd95ed2a3faa8f0d324e231d334f3f4564ab0c52b15b0f3e5d3247de797feb9f9b
SSDEEP 24576:Gwwj8+KVC+D45fxCmD6SymMp2wY760MdQIdLsdf8vnpokemyp4v8:GwMKVm5fxCmP3MpY7rM2Iho0vQmn
TLSH
T12485BDE57DB510B9F4E5CF0A055200D487C8D01AA8AC19DF3FBD84ED70846CBA6DB6AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mYkK.exe

Path C:\Windows\mYkK.exe
Size 2.2MB
SHA256 402c8cf4e6211dca96aeb82bae7b8f4e0a6784c87a69ee31edbeb5c9a724ada5
MD5 7077392166009767bf03a87784b08302
SHA1 f903992132243fcd272e884df40dcd1ceb9d16c1
SHA512 e9c4d46a9841b3b18e45a852824297e184e480f6dbe427aa769caa9843e2c20645e197855c1993d70f3a33a04ef4fae37459574a58be613dc072ce31d82418df
SSDEEP 49152:JkNlwkOkFHIh2GmUflZm0EKlf3qHcUZ+7WuAOeRU2vT:JkNlwkOklIh2GmEKcUcpJ2vT
TLSH
T198B51960FE63B24C82EE224F565D88332940C5DB8FA6D47893FB997E99233D11847CB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mcEG.exe

Path C:\Windows\mcEG.exe
Size 2.8MB
SHA256 41bd6f96aabb59307666bbde6a882419d104bc273760548cb6116bc85ce84413
MD5 3c42663d21ea1069281e5e7b6885308d
SHA1 8d7fa8b2b07c0cbc1b1ca13e573860653529c657
SHA512 dcff6192281e9ab15d7d4878f9d5793ff2083ee98ed6d92aa76ea021cd80b36f3dfa6c345a4e5f40ab176997b68ec8a3afca4f313966c5339e634c1572b63fb2
SSDEEP 49152:pisKGRCBUjusLbRlGcqGoOqajdRo/OqX6TG:piTaCB2rd/qodGR
TLSH
T125D55116D8A5AA5B82918A408E52905CFE09FC3FCD4DA58DFF3C1A83B1E51660B377DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mose.exe

Path C:\Windows\mose.exe
Size 1.7MB
SHA256 037dfd19d4f7188b07622348c87c69a441d9d237ecc89cab0ff4377671a42777
MD5 94054df28cd05d83532034a3e2d68bd9
SHA1 544fbeee813053c6b1b527ae83d98cfff8189607
SHA512 3a31ba6fe2b6ea70f983bf1f400bf145c1ed61396933c80dda943d4614dca800760c95f304c14ab1183071eb3514afecfba95e58332119730618dea20daa630b
SSDEEP 24576:bhqDzCFzY0i+D2AGjZkHPF+ybiKbgbKd8e:1nzYwS+brgbG8
TLSH
T1CD8519DA2B94B66F2DD79E5E7CEBCD18C1C3291D6EBBC3A418A36B243B401035E76054
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ocQU.exe

Path C:\Windows\ocQU.exe
Size 1.6MB
SHA256 e55188d395859924987c91fe1416eb354afeb5a23408bc1fb99e8fd8e539bfab
MD5 cf8d0724f1b2823b6b9e067068e4c76a
SHA1 8cba0e69b83ec3e476ffbe24502b45ed0b514171
SHA512 37d6e36556c09395967bdf874a12df215b2bd60033579ac27ae9d5a89b18546c3cb2f14cc9e999d195d131eb2628b704291a356621ff9a8de5d79be6816f37e1
SSDEEP 12288:FbMjMNd/mJf05NOmxnJn45Qpu0mwkmxFAFJ/V/YRjWDFAFX80JF7oIq:FFSc58Un6piQmRjZXPJlq
TLSH
T15575D922FB7568EE4DEC0845F546CD00468A6265CC8F472A7B78CA1DE144E727A4FEE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

okAG.exe

Path C:\Windows\okAG.exe
Size 2.1MB
SHA256 ce88099d905a1efd939f1e0703d85096e89d5d07b7c7b2fc6e6a5e4e14dc3936
MD5 a90d51ab856d696fba56361af9344f23
SHA1 b1a5976a1d260c941516ab8e267adae58fd1e689
SHA512 1672fb20f5a808ae263177a1528a644981ef62a0b3bb2a21f804795ea203a49917328ea8e115b989264185f2f2aec66f1fb36df75a0c1c4bef755aeec44ed302
SSDEEP 49152:NyigGMBFFVFY/R5jzHbf8fuIGEV+MfGW:xlMtgbHz/ETfGW
TLSH
T1BBA584C59D951887ECCEC2441FF6A4DB5C4F42A3DA313411B6BB24DCA93F2A9241AB7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osQS.exe

Path C:\Windows\osQS.exe
Size 1.8MB
SHA256 bfc1fbd94414a23e0b44227a6edc8d2afdd0ffab81734163825cb8435b2bceae
MD5 af831f0511b4c43baba8b2eb48de7d22
SHA1 33fa267b2008814922c539be22aaae757c95b388
SHA512 a2fdff0c1900202dda624a368fa4368afd8afd150487b987d91f08cd27335a89bfd8954472f515a49a2a73822e28c9c9b2b7ce72a1daccd212ee92276270337a
SSDEEP 24576:QTvIGnEmuAK9f7vpulNpPfod5E8j3Z4z1mDD:QjIGn53K9gOd5EG3Z21
TLSH
T1F1950E961F758E1FF4570F0BB0A4D4BE297804B1E1ABE452DC0BCCA2FAA435958C45EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

owAq.exe

Path C:\Windows\owAq.exe
Size 1.9MB
SHA256 0ce5aa2da97eb1cacc6835f78cb14b08e7149d39b2c1e6c0a04e9492504f0e4a
MD5 7e2cfe1c564cdab1f24c06303984e5aa
SHA1 8c5658f4cbafa9d5d96cb814082b5e55253f2ec2
SHA512 c8098f8c11a3170c7919f0960a0e17fb2fdd47cc731a54d1ebdbf6c2a6f6eea0a2c4aa71876e44974228d514e205de0480e2eaaba5a51b441fd4fd9a9f68bfa8
SSDEEP 24576:el9vdlkAHe3FrvO8ujs33F+fV5CjiqA4aUkvq6ZkZ6Nb:kFlkAe3Frv4i+rCjG48qv6
TLSH
T14E952C799BCD8E0201D5184795EEC08FEA4C7C7A65F4648CA6FF64B80D739BD62C90E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qMgQ.exe

Path C:\Windows\qMgQ.exe
Size 2.7MB
SHA256 fd354d3814b4415fca465e780584decf812d36b8848576db232d832276fe997f
MD5 82770da81d91f199a111703124bccb73
SHA1 406413106e8e9c01acf8b541ba15549446aad708
SHA512 77fdd123f211d6ecc82f119a98420d63ced853aa8e1db562eddbae87d0406bdb4d7f4a6d2ec39aacae93ce7f213f4f612ac375184ff73e66aa66cda8c899896c
SSDEEP 49152:jVqVaEEjakOcoLhnrQk+9/teQJEH/Qb1h26GZ/+ymQdi+lOvN5bS:qnrQF/te+4Qbir+yzdiIQ5bS
TLSH
T101D590EE962DAA27093E076C1DFF894DD2069CA0AECC53C5417B3664E762D384BF106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qcQs.exe

Path C:\Windows\qcQs.exe
Size 2.0MB
SHA256 b08985a4086af1939f57b1dd9495fcfe274308019f4e05fbb0c8322b5aad0058
MD5 da7194a7b750b2778057f483e357a0ab
SHA1 e7ebec3acaab8e0d3baa2ff82e452a8cab9a297d
SHA512 d41fe625b9f4988fb76c58474bbf9d70f2a19165ed487b3ad8c9fae05a506c76a5ec6a859b62d5dc4dcbe54a0347e52d26b72d7a344fbe58763f4a14bb3b2fb1
SSDEEP 24576:ABzEUqmZzppqsb6ctxzLkyWrRCyt+mTTu07N3ZOE/9r1Cr:eqm9Pnpoy29vjT/9r1
TLSH
T1EC95FE8E11A23255481942EFB64F6376329B77CE54C815FFBD7A9A03CF067A4B0EA131
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qgQa.exe

Path C:\Windows\qgQa.exe
Size 2.0MB
SHA256 7ab305afb21ad3a2e208858c7ab7bd0c247725dcdbe6fba42c67002c247f2dd1
MD5 6ac0ef2218139a699cbcb47116ee9f78
SHA1 132358c61f4ee0e7df248c5c838a1401cb9ced3e
SHA512 6a63e6d7fa3b058f93d43ccb42724e5e2126bdc6a4a1e9b42629ef71c6d73bc3c79af5ce6912fa2499ce7f610c12a5c18df230f0773a78b807b50c658a29d3fb
SSDEEP 24576:ItoSvmH0P9hJLKY2YWSyFkNmYthvC0zjvYau5FdWIXxDldkg6G:eopC9hNH2dzk7y0zjvYaus2kg
TLSH
T18CA58436EA268D1863F4481DED088D99DC361D439A3EC5BD2214E2C407EEE47D658FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwoC.exe

Path C:\Windows\qwoC.exe
Size 2.2MB
SHA256 5758902c9aaba93d8dec833a72862281191407c76843743ce06dd0017ef24a31
MD5 ad6409ebf8039a08acf66d32a8987b30
SHA1 05edda437069225fbda62ceae0c959ba1c9b1b01
SHA512 d7df792855f825cddbfa06a9e212a0395122da807d0ecee20b27db7f84f9bceb55065eb960e1360c89ab0f495d4e7302209e1c59321e6c0fb23e51227c7f67d5
SSDEEP 24576:dzgi5g6Kggnrse48yqVF/YH2D1arrrC7ilbSSi01n/NP5UaLKbGMrTLJ0SF/3vGq:a8wFyiruSdvGSugk
TLSH
T1EEB550BDD0D8EEF4380AF6EB78B4FD6A053D8BFC05A44A8D65CAD220D05151886D37DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sAcU.exe

Path C:\Windows\sAcU.exe
Size 2.0MB
SHA256 2462df0bb5067c59bed78e6cec934c227fe08cd4e72b07d4bc8c9bf6876ee844
MD5 100b2c3cf87dd4f7d6074cd33026c477
SHA1 31d91647bbbf9c75ce470cd5d983c590eaaab853
SHA512 98e29f848f4c72b7194004274131e81eefb4455b3e453fefd5639808dc4047c7392af577976f197407657c00403ed6f75a89ff7cbc150fb097d52c8b3eecd893
SSDEEP 24576:rJMop4P2RUhwrHo9HJrRa3e5IfhQTI8yFFi1OPAnrYmh8N:rJB4Puvrb3LhjNFIOP05hM
TLSH
T1D3A5B90E04729BC2B7DD96F951BB0F2C8F03836045E5F94C29F2AD87F97570911A6AE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sEES.exe

Path C:\Windows\sEES.exe
Size 1.6MB
SHA256 17f0969069c8b2715fb58f19c4a69b8ab94fadfd559ae174e341005a0c2e2678
MD5 c6957677c2817fb76c17a33c0ac14030
SHA1 0451546be49b55f58dbe5182444941d0417d0a98
SHA512 97611f7da710066715d28baf9fdb13b359da3a479bbaee05a253b0b43be317ecbcc7dbc76410c9ced5a0c629609467b44c4b1ab84cdd21df015574fad318e0c3
SSDEEP 24576:RnvFqVDPiai75kJv5ITZCytUo6e0EjTYEbYs:Rnv4Yav566
TLSH
T19875BAC7C535292F5F9D28778017F4FE963F22C646EBB5FA4D234AB97032062A54E1A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scIC.exe

Path C:\Windows\scIC.exe
Size 1.6MB
SHA256 40cdd755f061a4c69e9ff88ae7aa108281b7c9f254d6b152f0efa9fcd06ce3bf
MD5 1c2b7d88f99f1f18d1265d100ccec10f
SHA1 7f45313ab4b5580487f8e2b17f83cf6866a36fe2
SHA512 fc230eddfd5074d9a9e7cdb185288d741af4bf3b9f91774cb6a107f76f0d9d363a96abdbef24d713ef5adaa9a2bb595a3641349dc6725a2f1a895e25894c4fe8
SSDEEP 12288:kl0v1TXCpr29neYf3Cy7r1Uhcd0wr/YH9Bm3eHK2j+mGOwuNrOGWY1CzZ:kl0JuahP7BfbY/meHK2j+mv7yNYQ
TLSH
T15975DA909570E366FE4FCC90898DC59EA1B97FDFC984632A127A20ED26142DF4660DFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

soAm.exe

Path C:\Windows\soAm.exe
Size 2.0MB
SHA256 d4afced8f1862b4629f2fc116f460eb08496edb05e447021e06c4819cb121c06
MD5 7cb1f154116cba36e9000c4ccd6a2c05
SHA1 4b18d7d349daf6af8b0485c2b2be846718c5cb4d
SHA512 323b7995ab421a2dacd048553f3c1bd4362b0354c8b4ea5b5751dc89289784e7caa5304460861471669d576e851a07a61abb236691ea3d6144b605c193df24fa
SSDEEP 24576:D+aGnCOq0k/zvN+F6nUwxFag85JG1y35BgqI5Z6F8saFHtJ:DS2zpd8bGg3ziA8saX
TLSH
T1E4A50D5FDC493ACBDF054D96CCC53B276FC8826E1DE722B186F4152A9BD4D23AE26021
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ugAg.exe

Path C:\Windows\ugAg.exe
Size 1.6MB
SHA256 c79a142c9b8b92134ef4da52996ba436aa27e031ef2642c96958aff068dbac92
MD5 d7dff617eee358c5951cd8a5b9396240
SHA1 08388f3cc82b212d1c61a8baa390832ed9e32c72
SHA512 1e97165d105d26cd8e762ab570335c4d46a329180c912c03ffccbcefba62c883a7cb714f437d4eee88696f5afe30e8423b315f185a3a8a1a9e56c00179360820
SSDEEP 12288:omSfpzzb8PvKjvdWNImajOwg3KR8ANVBURVLK8jJrKUTTSfUpJ5aSx0zcRKshEsQ:6zJZZyw+KRJG7hjdKUThpXjK6qsn5K
TLSH
T1BC75BE1841DDEE8CB6187BA071530B8C651FBB921DBE6B4EBBC5EC9E6474203435892F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uskE.exe

Path C:\Windows\uskE.exe
Size 2.0MB
SHA256 eaf9a135667bc4f9aeda55a4e7a4871c2eb1c383fcff25070fe4ab5f5a5ef1f2
MD5 5a8a7bc8ef1e75e75879c665c7a5acdc
SHA1 e370c10dabfa2ab4abb3f9874831c892745a790a
SHA512 c92d180771399c57245759b96f351c81d347ae5993e80eaf2c0ef00a13844847575152534a480f5c9b481c9cc72266b57c9322f426d7217b11664a07a405b58f
SSDEEP 49152:XylSTMt1Wozm7CCU1C6SfoQvUC3xpt+gQ:XuSTMtF6XT6Sfp3xX+
TLSH
T1CEA53F296C3FE98D5507D16388812C653B49106BC312D7BCF262BC5F1F699F24A3A87E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uwAK.exe

Path C:\Windows\uwAK.exe
Size 3.1MB
SHA256 c25c3c065d48b435e337b3be6446f8146357d664df5010731aa24f2a130a015a
MD5 028035a778046f20f3a0205aed87cf08
SHA1 aefb9498f5b0426cbfa2e92a884cafb345ef4f47
SHA512 da08ce0d735a9a4708c149c4158f0c2998835eaeccc005eef19243832dce7afbf6d0368be2e455ab8114840967d97b10bc2a2ce149d44229c7ca972187779ca3
SSDEEP 98304:O0rYvf51LgI6hxxJ/O6z72eZcoBHRp3WqS:Od351EI626zHcoBxp37S
TLSH
T174E5D629ADE6B80DE813814B8BCFD4BD95B72E587D12C4E6DC63490C50B9725B38AF4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uwQq.exe

Path C:\Windows\uwQq.exe
Size 1.7MB
SHA256 64d98ba0ae064ee6e220ee71e327afd66f67906d4a236ccb8e0c58149eb960b6
MD5 48a29e77310ddeed1942fac62f5ba90f
SHA1 a8673470dd1d7cb49b9b4071167d32166622fa15
SHA512 1a1908c5425ed8bcf366d8496d2f63b6778e986236de4d2a6c20d5bd0b9e8aa2f0e8d44fe2b3445bebf42acf4f98f4b81dc118c7801b29f5dc980beb737bc3c4
SSDEEP 24576:sfp/hlO7Ep2xcDgJZeG47TFBR+ZAhF1TvMTn2:sxh72xPkPRLTvMT
TLSH
T1DB85D9812592B84BCE0FB8EF1D8A47E2C9E7C647C776D1D811E2A071F13551EBA14ECA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uwga.exe

Path C:\Windows\uwga.exe
Size 1.9MB
SHA256 1725b920ef9223e68f106fbe5d1d1b8ca5a6f6c1594dfcb88959e5324d0ce1f0
MD5 e1802f96984f41635da1103fbf7e730b
SHA1 66b5d50f4220906ffc5675f3c839bf9a33eb9175
SHA512 1fdf2d47f61fe0552a79ea2728dd99cf1445ac4ca91ee88a03406c418c5c5feeb9db3dfcbb4221cd136129dcfcc0bc194e8f6b7d2bf3e3abcf52610f3de495bb
SSDEEP 24576:AuPtQYDVoAxY7hukm2xxoOG1QuwueZjr9bHKGeq00z:RPtQYKMkmAoODg8BqGI
TLSH
T19895DB2C50FD2A3995D59966389B7940E9C81AEFF9A70D62EC3193408149EEFFC03772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wAIs.exe

Path C:\Windows\wAIs.exe
Size 2.1MB
SHA256 0c4a2d192e698a9d7448dc2dcb918851d5de7622135a336f75c87ed688a7045c
MD5 0f0b526d30834e5da1747c9c183c5372
SHA1 6ff347d8ff1d94668c0b74fb05935b12d1b6159b
SHA512 ec98df3e5782b7c71c71e9e4ac7e984f169e6b3468608df053a5b14fad48633ea839184119bb422fc321782efcaa896492c277eb4a968b96f0234bcd2e151183
SSDEEP 24576:qgZ8zmeNQ7/nnaHNUaZ36pnyaetV/Egdg22Mg70LJ2ACHonqSF3eXLRVI7PCK/XU:6KWzlGLHIj
TLSH
T197A52F3B559A8AB227158BC0E6521A07E4E0C85CA3F3AFF8D366F119CD54D9F8F74086
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wEgY.exe

Path C:\Windows\wEgY.exe
Size 1.9MB
SHA256 decad99ccc23b6ff781d8133adf6f0584692c1606fdec2780118266a15289510
MD5 4d36b178386ecb6da0b3b8c27842b66f
SHA1 e38fb79dd8d11d812c2522d9458592b0fb6c32fb
SHA512 be4e25ac8a5bdc1e42161eecfb2d5e4e1445e7e97f488e1293dacda527510ac8f03048f4b68f063493088701ada6505f40a9abb6ec126f5a1f6ec54e2c99fdb2
SSDEEP 12288:Bh2Axwa+CJQd53GH6EGRusaBmCoi+uBYT7epYtGRqlrY2VHu4JJoLTlBO9C:Bh2tCJQT3iHGsJT06tuPHC3lBO
TLSH
T10B9599B2B70618A68137949B4E2F99E9F232E3DB5C3A70D9442384B37EDC52364FE115
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wMMA.exe

Path C:\Windows\wMMA.exe
Size 1.6MB
SHA256 3aa7da3423ef98faeeff60b2c669e47ab1be743a3dd361a4b5f3350778a77551
MD5 8c812de65e9df4e458394dde9c67d1a8
SHA1 fd9f3f7cd52d4f10f7784acceb54980fee9cf6f1
SHA512 dcc76f7c4f168de19614cbd9f22dcd34f528a75851b3549c9533c2badb1b69bdad50a05fe872ce1f730311032af4fb6e5e24cf7a868c28178798951547fc6fd8
SSDEEP 49152:7Kww0www7hwwwcwmwwwfwiwwwlwFwwwTuwUwwwiUw9www9wEwmwww3wTwhwwwvNM:7Y5LMI1G6
TLSH
T17F7589943DB7B2D8E3D619B132BD39BD1F131D8DC6B9E581CA4FBE1A1D6AF022048095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wgIg.exe

Path C:\Windows\wgIg.exe
Size 2.0MB
SHA256 d4e153baa7e585351a533574cc31564b53726ae2dc460b33a20e7f0d6f256edd
MD5 6b3aa5c70cf54ba89d76c76a462e582a
SHA1 ff98170b4cf1ee0d81ecf3d055c81309672a6a62
SHA512 f28933d5831330897f02580e3d3c042f41f5bd26f86ed9bf3c7c093c361e559cf41db653d139150717c603b03007c8a668a881b3bccce98d4d29d6538e0554b7
SSDEEP 24576:UI/jQrDSx4rvvjEs6azUwaaEf/uFnzynMFfAVelqYUtO4Bmf6RU3N93evBh5wkSU:UI/8VrnAsT/aZRmy+3N93UC
TLSH
T14195526999B113C4FCF3885DA668DA36752C4C3961AD32808A0FB797F8C4962B53F371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wkcg.exe

Path C:\Windows\wkcg.exe
Size 2.4MB
SHA256 6ae8800b2cdcba958a841cd97854a50090c8ce5851f6a7583cba45f63ba4e63b
MD5 e1dce84ef844f441a9a8e89f6b393641
SHA1 f1e04b827968b7f2fa4bdbdc0cdc7b37ac67adb5
SHA512 1cbc2d628bedb6e9f706183c1af5e687aa31179f9e3df4936fe5b00bdae758334d7f42d4909dc2739e0be6179e790b86bb016f304b4ea1a7029f2f131085044a
SSDEEP 49152:cWKn0T+UueQwmDtzoSiD5tt99OhLxWsAF4s:WnY+UKDtzfittT98xWsAF4s
TLSH
T18EC58156FC5F34E1927FC7598BC864C83FFD6C8A87FB5EAA24A2662500450379230ADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wkgw.exe

Path C:\Windows\wkgw.exe
Size 1.9MB
SHA256 9adb1a39f4ef72d42a2572e4a216ee3e58d32286fc817d7f7a9362fb174912e6
MD5 99a03f42d9aa96fb06ab50f8c2f35105
SHA1 b35a70b5d59763c95ea7da9a01529275332d30d9
SHA512 17fb2bcc0571a3f62a2fdb311fc1c0f361e9be3a2f1d635af3700cc1493ccbe0946c19c2d1b222b6157a49e9a35ac41458335aef1d023fa2cb4a292f7c17ee41
SSDEEP 24576:b/UnAhBh0hgqPKo7ylLdoYxhP9ovnOJdsDzscZ+rXPJk2g2RoI/vXHb0tb9yw5:gnAhBh/qPKo7R2W1yPJU0/vX7C/5
TLSH
T13195EB89EF6C398E423E3C347091A557B7A5DBD619F68278A0041FD004D79CEAD87F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

woMk.exe

Path C:\Windows\woMk.exe
Size 1.9MB
SHA256 d02e561a67334e66a9a1b21c4656721ea3c3ea15a30e9a56ec36f5da37d9e7c3
MD5 1c827fe3f928a2c2ce122b7b37d99d29
SHA1 8ce85626b9e13d7f4f87e968026acd18d0b0c891
SHA512 6e545714e88c7d81ea0284a5a8781dd72f2efc66fc21c1c1ed37e9acab40a67b0ccff72f79748056c44c7c6555e215d8051c1e2d245f0caace7c9d01263f2cf4
SSDEEP 12288:0fG0FDDCSsjyw/o1q2h9PXTtXHIsYKmdCJbbOxNpfyg5AVdc3unLeTjlY64ltqij:qDDhsqPZHIsYVkb65fF5AVeqLkY+TL
TLSH
T1069549124B08921FE8F0A374B67DB4DBF055C2B6A8FAD509B9ADC0911E6574F2F12F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yUcq.exe

Path C:\Windows\yUcq.exe
Size 2.9MB
SHA256 21f949725b7aca137dd83f040100e1af684aea22700b339d4b7b38b7fbe5c5fe
MD5 ff6ba19d53ce1a7c52dd5baae9eb32f4
SHA1 50d78963eefef0d534f79c25bd589b8a570912b2
SHA512 3503889b36280e86d81017464956567141c5f2085f47c2678ba237bb7ec7771f1245de8eba30d5db9c64f12c7ab90501834400fede3b3cb00c8294da5ffdaa86
SSDEEP 49152:BYUfRr7SAPruTAvTzOWQwc2c3veBbbsRFHspk:eUfRpPya4J2BBbbKFH/
TLSH
T1CEE5D317E935B88278D74E1A7357A84AF1F4CAD509321030F39F4CA25E7BD84AAD706E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ygMm.exe

Path C:\Windows\ygMm.exe
Size 1.6MB
SHA256 ca2aff014b2d290ac193d05da181f5e34ca2bacf4c2958cd09f01e3dec5cec70
MD5 cd36fa6d8a7c602cef5494b2f63d799b
SHA1 eb7ec7e89ef3694cbc7d5f14b6a4c15fd93bfa7e
SHA512 c95c19362e1f04557b16a9e5a3ae0bf7ca36f698b37e8dbb78c846a826c83c5f7c2da0467e15ef4a1a5609a764b9b546af2876ae8cfadc2e955ea469d4a4f0cd
SSDEEP 12288:JDws3RGZ6vgLltTCHCfN9qG/VdaU8RG8wp9AJP8D3eYUdfc+29r:qfDd/VEU8RG8w3eYME+2
TLSH
T1B875C97E7892DE8D2525A3343C8B98AB4D7FCCBB040F0C69C47F661268BD51E89B45D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/308-169-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/964-786-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/1812-1-0x00000000023B0000-0x00000000023D0000-memory.dmp

Download

memory/1812-32-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/1812-33-0x00000000023B0000-0x00000000023D0000-memory.dmp

Download

memory/1812-0-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/1952-109-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/2104-869-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/2252-139-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/2328-267-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/2880-2090-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/3076-153-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/3416-521-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/3500-184-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/3544-421-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/3572-244-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/3592-361-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/3648-46-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/4076-78-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/4120-2085-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/4120-20-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/4136-2095-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/4268-645-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/4364-197-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/4376-65-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/4524-7-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/4524-2075-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/4772-16-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/4772-2080-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/4804-125-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/4824-235-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/4948-95-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/5524-225-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/5916-211-0x0000000000400000-0x00000000005B1000-memory.dmp

Download