Overview

overview

10

Static

static

3

2026-08-09...ck.exe

windows10-2004-x64

10

2026-08-09...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 02:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe
  • Size 1.9MB
  • Sample260809-clfmjssta1
  • SHA256 b3cc0fc43672b542a8a3404ad09df10686ad5fb850d805df6fd3f147c49a62ff
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 13 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 13 IoCs
    defense_evasiontrojan
  • Renames multiple (94) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 13 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 26 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 39 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3444
    • C:\Users\Admin\zagkoMgE\nEkswUAE.exe
      "C:\Users\Admin\zagkoMgE\nEkswUAE.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:3308
    • C:\ProgramData\HMYYwEsc\rWEQIwgE.exe
      "C:\ProgramData\HMYYwEsc\rWEQIwgE.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:4964
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4232
      • C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2720
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3676
          • C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:916
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2500
              • C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3544
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:5772
                  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:5544
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:1656
                      • C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock
                        11⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:3988
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:3348
                          • C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:4296
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock"
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:2672
                              • C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock
                                15⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:4636
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:5756
                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock
                                    17⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:1104
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock"
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:4260
                                      • C:\Windows\System32\Conhost.exe
                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        19⤵
                                          PID:3460
                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe
                                          C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock
                                          19⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:1752
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock"
                                            20⤵
                                            • Executes a command shell one-liner
                                            • System Location Discovery: System Language Discovery
                                            PID:2316
                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe
                                              C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock
                                              21⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:3160
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock"
                                                22⤵
                                                • Executes a command shell one-liner
                                                • System Location Discovery: System Language Discovery
                                                PID:5616
                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe
                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock
                                                  23⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4376
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock"
                                                    24⤵
                                                    • Executes a command shell one-liner
                                                    PID:480
                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe
                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock
                                                      25⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:4976
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock"
                                                        26⤵
                                                        • Executes a command shell one-liner
                                                        • System Location Discovery: System Language Discovery
                                                        PID:248
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                        26⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Modifies registry key
                                                        PID:5152
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                        26⤵
                                                        • Modifies registry key
                                                        PID:4520
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                        26⤵
                                                        • UAC bypass
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry key
                                                        PID:5684
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LsQIsgUc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe""
                                                        26⤵
                                                        • Executes a command shell one-liner
                                                        PID:4588
                                                        • C:\Windows\SysWOW64\cscript.exe
                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                          27⤵
                                                          • Executes a VBScript file via the Windows Script Host.
                                                          PID:5300
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                    24⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Modifies registry key
                                                    PID:4224
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                    24⤵
                                                    • Modifies registry key
                                                    PID:4016
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                    24⤵
                                                    • UAC bypass
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry key
                                                    PID:4028
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hmQwQEEE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe""
                                                    24⤵
                                                    • Executes a command shell one-liner
                                                    • System Location Discovery: System Language Discovery
                                                    PID:1568
                                                    • C:\Windows\System32\Conhost.exe
                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      25⤵
                                                        PID:5032
                                                      • C:\Windows\SysWOW64\cscript.exe
                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                        25⤵
                                                        • Executes a VBScript file via the Windows Script Host.
                                                        PID:4924
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                  22⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry key
                                                  PID:4328
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                  22⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry key
                                                  PID:3548
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                  22⤵
                                                  • UAC bypass
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry key
                                                  PID:4220
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kUoosgok.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe""
                                                  22⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1988
                                                  • C:\Windows\SysWOW64\cscript.exe
                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                    23⤵
                                                    • Executes a VBScript file via the Windows Script Host.
                                                    • System Location Discovery: System Language Discovery
                                                    PID:4564
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                              20⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry key
                                              PID:4012
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                              20⤵
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry key
                                              PID:1900
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                              20⤵
                                              • UAC bypass
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry key
                                              PID:2968
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mUUAIscY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe""
                                              20⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              PID:2128
                                              • C:\Windows\SysWOW64\cscript.exe
                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                21⤵
                                                • Executes a VBScript file via the Windows Script Host.
                                                • System Location Discovery: System Language Discovery
                                                PID:904
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                          18⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Modifies registry key
                                          PID:2708
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                          18⤵
                                          • Modifies registry key
                                          PID:4468
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                          18⤵
                                          • UAC bypass
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry key
                                          PID:3564
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kmIIgAwo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe""
                                          18⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          PID:5880
                                          • C:\Windows\SysWOW64\cscript.exe
                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                            19⤵
                                            • Executes a VBScript file via the Windows Script Host.
                                            • System Location Discovery: System Language Discovery
                                            PID:2272
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                      16⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Modifies registry key
                                      PID:432
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                      16⤵
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry key
                                      PID:2824
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                      16⤵
                                      • UAC bypass
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry key
                                      PID:980
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NKUUEUkA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe""
                                      16⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:4616
                                      • C:\Windows\SysWOW64\cscript.exe
                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                        17⤵
                                        • Executes a VBScript file via the Windows Script Host.
                                        • System Location Discovery: System Language Discovery
                                        PID:5328
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                  14⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry key
                                  PID:1976
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                  14⤵
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry key
                                  PID:1392
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                  14⤵
                                  • UAC bypass
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry key
                                  PID:4856
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jeEQAEMU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe""
                                  14⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:3088
                                  • C:\Windows\SysWOW64\cscript.exe
                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                    15⤵
                                    • Executes a VBScript file via the Windows Script Host.
                                    PID:6120
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                              12⤵
                              • Modifies visibility of file extensions in Explorer
                              • System Location Discovery: System Language Discovery
                              • Modifies registry key
                              PID:4900
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                              12⤵
                              • System Location Discovery: System Language Discovery
                              • Modifies registry key
                              PID:1568
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                              12⤵
                              • UAC bypass
                              • System Location Discovery: System Language Discovery
                              • Modifies registry key
                              PID:5032
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DEAgksgU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe""
                              12⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:1648
                              • C:\Windows\SysWOW64\cscript.exe
                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                13⤵
                                • Executes a VBScript file via the Windows Script Host.
                                • System Location Discovery: System Language Discovery
                                PID:3492
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                          10⤵
                          • Modifies visibility of file extensions in Explorer
                          • Modifies registry key
                          PID:4556
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                          10⤵
                          • System Location Discovery: System Language Discovery
                          • Modifies registry key
                          PID:5424
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                          10⤵
                          • UAC bypass
                          • Modifies registry key
                          PID:3736
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AcUIMsws.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe""
                          10⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:6036
                          • C:\Windows\SysWOW64\cscript.exe
                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                            11⤵
                            • Executes a VBScript file via the Windows Script Host.
                            PID:1276
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • System Location Discovery: System Language Discovery
                      • Modifies registry key
                      PID:1332
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                      8⤵
                      • System Location Discovery: System Language Discovery
                      • Modifies registry key
                      PID:2024
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                      8⤵
                      • UAC bypass
                      • Modifies registry key
                      PID:2784
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kScAIkks.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe""
                      8⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:2384
                      • C:\Windows\SysWOW64\cscript.exe
                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                        9⤵
                        • Executes a VBScript file via the Windows Script Host.
                        • System Location Discovery: System Language Discovery
                        PID:1172
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                  6⤵
                  • Modifies visibility of file extensions in Explorer
                  • System Location Discovery: System Language Discovery
                  • Modifies registry key
                  PID:956
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry key
                  PID:4824
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                  6⤵
                  • UAC bypass
                  • System Location Discovery: System Language Discovery
                  • Modifies registry key
                  PID:716
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QGQEoYgI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe""
                  6⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2036
                  • C:\Windows\SysWOW64\cscript.exe
                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                    7⤵
                    • Executes a VBScript file via the Windows Script Host.
                    PID:2860
            • C:\Windows\SysWOW64\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
              4⤵
              • Modifies visibility of file extensions in Explorer
              • Modifies registry key
              PID:5576
            • C:\Windows\SysWOW64\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
              4⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry key
              PID:1724
            • C:\Windows\SysWOW64\reg.exe
              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
              4⤵
              • UAC bypass
              • System Location Discovery: System Language Discovery
              • Modifies registry key
              PID:4820
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PeoEMUMI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe""
              4⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:588
              • C:\Windows\SysWOW64\cscript.exe
                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                5⤵
                • Executes a VBScript file via the Windows Script Host.
                • System Location Discovery: System Language Discovery
                PID:3460
        • C:\Windows\SysWOW64\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
          2⤵
          • Modifies visibility of file extensions in Explorer
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:3164
        • C:\Windows\SysWOW64\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
          2⤵
          • Modifies registry key
          PID:4576
        • C:\Windows\SysWOW64\reg.exe
          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
          2⤵
          • UAC bypass
          • Modifies registry key
          PID:5556
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VEkgsgoA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock.exe""
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2176
          • C:\Windows\SysWOW64\cscript.exe
            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
            3⤵
            • Executes a VBScript file via the Windows Script Host.
            • System Location Discovery: System Language Discovery
            PID:4740
      • C:\ProgramData\hyoIcQww\sgAsgckw.exe
        C:\ProgramData\hyoIcQww\sgAsgckw.exe
        1⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        PID:5196
      • C:\ProgramData\HMYYwEsc\rWEQIwgE.exe
        C:\ProgramData\HMYYwEsc\rWEQIwgE.exe
        1⤵
        • Executes dropped EXE
        • Adds Run key to start application
        PID:2480
      • C:\Users\Admin\zagkoMgE\nEkswUAE.exe
        C:\Users\Admin\zagkoMgE\nEkswUAE.exe
        1⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:1312

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            2
            T1059

            Visual Basic

            1
            T1059.005

            Windows Command Shell

            1
            T1059.003

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Privilege Escalation

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Defense Evasion

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Hide Artifacts

            1
            T1564

            Hidden Files and Directories

            1
            T1564.001

            Impair Defenses

            1
            T1562

            Disable or Modify Tools

            1
            T1562.001

            Modify Registry

            4
            T1112

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            System Information Discovery

            1
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            rWEQIwgE.exe
            • Path C:\ProgramData\HMYYwEsc\rWEQIwgE.exe
            • Size 1.6MB
            • SHA256 7d56cc3a1f80895248a7d41e95d4056faeb02a6268220525edeadca8f8e0e685
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            rWEQIwgE.inf
            • Path C:\ProgramData\HMYYwEsc\rWEQIwgE.inf
            • Size 4B
            • SHA256 73d96eebd437642aa1508b4befe68e4791a5cc1cfdf51fb2f8fe548a4d212a29
            • MD5 SHA1 SHA512
            Submit Download

            rWEQIwgE.inf
            • Path C:\ProgramData\HMYYwEsc\rWEQIwgE.inf
            • Size 4B
            • SHA256 95500997057060a0a45ad9af9539b9be6cc42f18a4d6a79b13dc6602aaf1b4ac
            • MD5 SHA1 SHA512
            Submit Download

            rWEQIwgE.inf
            • Path C:\ProgramData\HMYYwEsc\rWEQIwgE.inf
            • Size 4B
            • SHA256 59e6c430f77506a109df5652d6b40b08e3c7c4f38fbdfc09fa93bec43d667ca2
            • MD5 SHA1 SHA512
            Submit Download

            rWEQIwgE.inf
            • Path C:\ProgramData\HMYYwEsc\rWEQIwgE.inf
            • Size 4B
            • SHA256 7175f3d45228bbd8c49804ebccc5f5436e55e8f417e5dff976a6cbb1afd51d46
            • MD5 SHA1 SHA512
            Submit Download

            fOwQ.txt
            • Path C:\ProgramData\fOwQ.txt
            • Size 8KB
            • SHA256 c56d839221d79822462865490e9d186577c218389049400db8fee8de12256848
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sgAsgckw.exe
            • Path C:\ProgramData\hyoIcQww\sgAsgckw.exe
            • Size 1.6MB
            • SHA256 35d9d2657646b9189b42c470f3ffa0338b56fd8d29608584915b0fb11386a0a8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock
            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-09_71907f88331326a8bbb3c34f1fb1352e_elex_virlock
            • Size 392KB
            • SHA256 dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AQQo.exe
            • Path C:\Users\Admin\AppData\Local\Temp\AQQo.exe
            • Size 2.0MB
            • SHA256 8115bbd81784c7394689f074a94e0529263b140c441da994057440c651f57289
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AYEO.exe
            • Path C:\Users\Admin\AppData\Local\Temp\AYEO.exe
            • Size 1.6MB
            • SHA256 7ee5d9e5a21726ea3fc92e16b4631c1f4f71234897d6a7e9e2348a860f4bf5cd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AYQE.exe
            • Path C:\Users\Admin\AppData\Local\Temp\AYQE.exe
            • Size 1.6MB
            • SHA256 c6f95348728155484e438619f2a44ec4c3650a67656e6839c73094853b23b3ff
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Acka.exe
            • Path C:\Users\Admin\AppData\Local\Temp\Acka.exe
            • Size 2.2MB
            • SHA256 a2f9fe74d2d22a10966a9dd88c8c2d64c838e1fc66c35a4dba73f4824020833d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CAwi.exe
            • Path C:\Users\Admin\AppData\Local\Temp\CAwi.exe
            • Size 3.6MB
            • SHA256 ce7b7bd3962ee11ec9253367f195d20c58c8d24d4323dd74e95b2bcf86b2d270
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CEIE.exe
            • Path C:\Users\Admin\AppData\Local\Temp\CEIE.exe
            • Size 2.0MB
            • SHA256 b60f7b008ee7563f5f29c75f7a9d8b4f739a87bd4dcfb150f8c6548c67108305
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CMUq.exe
            • Path C:\Users\Admin\AppData\Local\Temp\CMUq.exe
            • Size 1.6MB
            • SHA256 a5b85c9682a2886b6f65c03774b30e0445e39cc08a5e2e8bd645a75f6d18c4e2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CeUQ.ico
            • Path C:\Users\Admin\AppData\Local\Temp\CeUQ.ico
            • Size 4KB
            • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CkAc.exe
            • Path C:\Users\Admin\AppData\Local\Temp\CkAc.exe
            • Size 2.0MB
            • SHA256 5b17864cadefc77a278a0301bbf17f9d7833de6b1f242ae3dbf9e59e7d5bb6ca
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CkIg.exe
            • Path C:\Users\Admin\AppData\Local\Temp\CkIg.exe
            • Size 1.6MB
            • SHA256 9edf8ba54ed202474275cd7ac841d8f2b1164b4d2da3ea8919fb54e1af549072
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CwYk.exe
            • Path C:\Users\Admin\AppData\Local\Temp\CwYk.exe
            • Size 2.9MB
            • SHA256 3805da4f79fad77182fc1e9e328d9182cd1fce7ec4fd8debed1e734c0c02c61e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            EAEA.exe
            • Path C:\Users\Admin\AppData\Local\Temp\EAEA.exe
            • Size 1.6MB
            • SHA256 84a36ea3f81427ecd10cc9dc3615618e2228f152a398146cc0db6a4265655be7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            EAQK.exe
            • Path C:\Users\Admin\AppData\Local\Temp\EAQK.exe
            • Size 1.6MB
            • SHA256 7392b663d05d6df1bb4177fbb987e3899bf04c9c829eccbd12fc36527fc4887d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            EEgU.exe
            • Path C:\Users\Admin\AppData\Local\Temp\EEgU.exe
            • Size 2.5MB
            • SHA256 6f412261ee9027186d91bf796512cd128c8e0ad58217ba63fcc38eb565b33adc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            EMgy.exe
            • Path C:\Users\Admin\AppData\Local\Temp\EMgy.exe
            • Size 1.8MB
            • SHA256 b39d143332e562580d8b5e607c3b6898a0fc34adde788a253164a48bd90c205f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            EOkc.ico
            • Path C:\Users\Admin\AppData\Local\Temp\EOkc.ico
            • Size 4KB
            • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            EQQg.exe
            • Path C:\Users\Admin\AppData\Local\Temp\EQQg.exe
            • Size 2.2MB
            • SHA256 967afacbc64d58c658ec02065f8741813602bfa60c0bb73c5499494d4e2be2f6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            EQsy.exe
            • Path C:\Users\Admin\AppData\Local\Temp\EQsy.exe
            • Size 2.0MB
            • SHA256 dc45857e6eec1ea7217d701fc770d3e387b23682c788d4950093edf364e4cc09
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            EYkg.exe
            • Path C:\Users\Admin\AppData\Local\Temp\EYkg.exe
            • Size 2.0MB
            • SHA256 87942d4c2b8b081cd731db2052510c18c80e4bc84041377d4d59b05e5fd57f7b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Ecwy.exe
            • Path C:\Users\Admin\AppData\Local\Temp\Ecwy.exe
            • Size 1.8MB
            • SHA256 5c864dd2cb33b49c27b02bc2a6092e255d98d6aff96e8a71c33bd948d3db07e3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            GEUm.exe
            • Path C:\Users\Admin\AppData\Local\Temp\GEUm.exe
            • Size 2.4MB
            • SHA256 454a713b7af219369e5452878249cf04ed93e03f262dca292abc75207ebf3ad6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            GYEK.exe
            • Path C:\Users\Admin\AppData\Local\Temp\GYEK.exe
            • Size 1.8MB
            • SHA256 0c1bc21253236373512ab728c3d402620bbf5c4609f8be6ab21136b10acf3dd6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Ggsu.exe
            • Path C:\Users\Admin\AppData\Local\Temp\Ggsu.exe
            • Size 1.7MB
            • SHA256 69e755881600135bf28b9d3d0b13d6145595d5837f446cbea7a8ad09c1c9b35d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            GoYm.exe
            • Path C:\Users\Admin\AppData\Local\Temp\GoYm.exe
            • Size 1.9MB
            • SHA256 20def96818400d40a700dc4da2c047432e60e7a2328e5a17557bde3ffd4f1095
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IEMm.exe
            • Path C:\Users\Admin\AppData\Local\Temp\IEMm.exe
            • Size 1.6MB
            • SHA256 4b2045318ededb40b76c54b200697c79a199c197177cb0209d061f7586215c50
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IgkM.exe
            • Path C:\Users\Admin\AppData\Local\Temp\IgkM.exe
            • Size 1.9MB
            • SHA256 7a4a060aea732b1d350c6212e42e31f91d272811c106f7731030016f13aa2ac5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IkQA.exe
            • Path C:\Users\Admin\AppData\Local\Temp\IkQA.exe
            • Size 2.2MB
            • SHA256 2dfaa250ebc8c0bb9e0c1e17cc4992c8cbaf644faea7fbe776321d030ecc2ec7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IsUs.exe
            • Path C:\Users\Admin\AppData\Local\Temp\IsUs.exe
            • Size 2.0MB
            • SHA256 098181bf96362a1f39ad569be1f976ecaca45786cb77527374fa974b602ccd8a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            KQMq.exe
            • Path C:\Users\Admin\AppData\Local\Temp\KQMq.exe
            • Size 1.9MB
            • SHA256 b18d1f7cef189782f2b1636b96d29f43989d5630cc31889ab38c0de001018018
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            KcYk.exe
            • Path C:\Users\Admin\AppData\Local\Temp\KcYk.exe
            • Size 1.6MB
            • SHA256 2e988f9b57654cf86f72925758ca90197df0727ac17cdfc3469bf835ee1202ff
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Kcoe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\Kcoe.exe
            • Size 2.2MB
            • SHA256 9282954581cd0952bad237fafab9ba72a8304d0d377aa15e6efdeae4dd2c00ac
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            KgUI.exe
            • Path C:\Users\Admin\AppData\Local\Temp\KgUI.exe
            • Size 2.2MB
            • SHA256 781234aa39daabf656a49e5c6346920586c8449e636b8ca57e93405fa5805c83
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MMci.exe
            • Path C:\Users\Admin\AppData\Local\Temp\MMci.exe
            • Size 1.7MB
            • SHA256 ca95e67650536b0351bab30889d24527ee20ea1086b0fdfe6fb1de1de4c0d760
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MQIM.exe
            • Path C:\Users\Admin\AppData\Local\Temp\MQIM.exe
            • Size 1.8MB
            • SHA256 42d5549682d5d5dc0f85895a0a92269130f9c73d0e4b8c3ccc8d89d539f6ccf6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MUwc.exe
            • Path C:\Users\Admin\AppData\Local\Temp\MUwc.exe
            • Size 1.6MB
            • SHA256 b2c96380b915919965e276d430dce3cf7e9d0b5e2b33065e705f94575fa9bc66
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MoAK.exe
            • Path C:\Users\Admin\AppData\Local\Temp\MoAK.exe
            • Size 2.2MB
            • SHA256 bd968c35f4c0fc8aefaacb7ba151864408b6820cbce333e20f46753e4f82155f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MqQQ.ico
            • Path C:\Users\Admin\AppData\Local\Temp\MqQQ.ico
            • Size 4KB
            • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OAAC.exe
            • Path C:\Users\Admin\AppData\Local\Temp\OAAC.exe
            • Size 1.6MB
            • SHA256 a7b5f0a25ae2c99f1d76f01deedca5745b5fc22e20fa44aebdb518ec81685c53
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OEgq.exe
            • Path C:\Users\Admin\AppData\Local\Temp\OEgq.exe
            • Size 1.6MB
            • SHA256 6284330c938c1cb1d25a3a91ee55bf5908ead561256802fd8891fb9f2d707504
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OIEw.ico
            • Path C:\Users\Admin\AppData\Local\Temp\OIEw.ico
            • Size 4KB
            • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OIIa.exe
            • Path C:\Users\Admin\AppData\Local\Temp\OIIa.exe
            • Size 1.6MB
            • SHA256 e1ee6d8d8db4904eb4217e2209dfc538b14388c838f2f4cb51e3bc529ec7501b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OYIc.exe
            • Path C:\Users\Admin\AppData\Local\Temp\OYIc.exe
            • Size 1.6MB
            • SHA256 48f6bd60f1b1254278aa2f7a9ca998fa2fb43e064299751d88c550090ef519ed
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OigU.ico
            • Path C:\Users\Admin\AppData\Local\Temp\OigU.ico
            • Size 4KB
            • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OkQY.exe
            • Path C:\Users\Admin\AppData\Local\Temp\OkQY.exe
            • Size 1.6MB
            • SHA256 4b1c2d939e8bdc1cb00d1d70c0db3450f0f89179e931f09d9898877d44eb0b1f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OkYE.exe
            • Path C:\Users\Admin\AppData\Local\Temp\OkYE.exe
            • Size 1.6MB
            • SHA256 6ed24562c5a949629578660b938e39493ed1cda8d3cf16e843a075e0531c9f9c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QIMe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\QIMe.exe
            • Size 1.6MB
            • SHA256 d6a980acd820956a4c2be7eb6263cceec457a512f591a3a6e71a4c6405d935b0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QYkk.exe
            • Path C:\Users\Admin\AppData\Local\Temp\QYkk.exe
            • Size 1.6MB
            • SHA256 4e156e1202884f350537405f0515004778c2dc0e709d4727629735ce5754a2ba
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QssQ.exe
            • Path C:\Users\Admin\AppData\Local\Temp\QssQ.exe
            • Size 1.9MB
            • SHA256 a6f674ade3cc36ed4ae9535a5116c0a5610d7157f35a1c4f0d7317e9ae8922a6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QswU.exe
            • Path C:\Users\Admin\AppData\Local\Temp\QswU.exe
            • Size 1.6MB
            • SHA256 875a55771d45da26835406a9fac3e7aa7c80689b84b36fe11ad1cdd416681b40
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SEEe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\SEEe.exe
            • Size 1.7MB
            • SHA256 bc579e84238d3f687bd9c7f82818a20c52ba318a6acd934ad58659031df35988
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SIwE.exe
            • Path C:\Users\Admin\AppData\Local\Temp\SIwE.exe
            • Size 2.1MB
            • SHA256 2f0e7f01792ed4fdac557857a921be13172f5f01538a331a731f3e2f2d269033
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SMoY.exe
            • Path C:\Users\Admin\AppData\Local\Temp\SMoY.exe
            • Size 2.5MB
            • SHA256 3ff939d8a4ce4fdedd0ec74d03dd14dbb53caf51c1fdf0514a4561bf96c5746f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SUQE.exe
            • Path C:\Users\Admin\AppData\Local\Temp\SUQE.exe
            • Size 2.0MB
            • SHA256 31ddd76a43cafd0d52ba38db435b018cf38b147f52f6d2d3a4d3923aff27330f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Scgs.exe
            • Path C:\Users\Admin\AppData\Local\Temp\Scgs.exe
            • Size 1.6MB
            • SHA256 78ae5497d2c315bb0c2b195fddcb3af8ed28e1f69a05acd1c47babd3f6aea539
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SwoI.exe
            • Path C:\Users\Admin\AppData\Local\Temp\SwoI.exe
            • Size 2.0MB
            • SHA256 b394706bdfce794004bd3b586fd80e2583e2ac9d02edd8943351b982ab2e91ad
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UAIk.exe
            • Path C:\Users\Admin\AppData\Local\Temp\UAIk.exe
            • Size 2.0MB
            • SHA256 08a9725d6ac95421bf40e87f6d7ee1a954a51ebb16f15bd20786c1503fc3397e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UIcg.ico
            • Path C:\Users\Admin\AppData\Local\Temp\UIcg.ico
            • Size 4KB
            • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UUMk.exe
            • Path C:\Users\Admin\AppData\Local\Temp\UUMk.exe
            • Size 2.2MB
            • SHA256 15137bf09c3b2e0083c8ddd67484ebc4c3bf4eaaafeaed4dd6dc9575e57da97a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UUUC.exe
            • Path C:\Users\Admin\AppData\Local\Temp\UUUC.exe
            • Size 2.2MB
            • SHA256 ab2a3510135f6ebfc67c253767a4439a9def38cfe72663d126b0921687f10dc6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UYEO.exe
            • Path C:\Users\Admin\AppData\Local\Temp\UYEO.exe
            • Size 1.7MB
            • SHA256 c94f679dd06adb5513f8fbef6a95b283f48ef1c9e692d51d55c891c9e5977604
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VEkgsgoA.bat
            • Path C:\Users\Admin\AppData\Local\Temp\VEkgsgoA.bat
            • Size 112B
            • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            WAos.exe
            • Path C:\Users\Admin\AppData\Local\Temp\WAos.exe
            • Size 2.1MB
            • SHA256 f14831483380d1851587b120ff139cd0371c2c92b01643950e0eb930d235c193
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WMQc.exe
            • Path C:\Users\Admin\AppData\Local\Temp\WMQc.exe
            • Size 1.6MB
            • SHA256 d682f9484e6c28775378a6ee5a1a7e4e6f3199dde4cb57a660b3d210abaab009
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WQsg.exe
            • Path C:\Users\Admin\AppData\Local\Temp\WQsg.exe
            • Size 1.6MB
            • SHA256 7c1ea28badcb562215190efd70c37845420941f89063a586b533cf2c3848c3b4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WYUQ.exe
            • Path C:\Users\Admin\AppData\Local\Temp\WYUQ.exe
            • Size 1.6MB
            • SHA256 8ffca6fb402e259bfaa420678578c9913fab39382407118af1c1c1d57ce9565a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WcwW.exe
            • Path C:\Users\Admin\AppData\Local\Temp\WcwW.exe
            • Size 1.6MB
            • SHA256 b64962d0a3f1a1920eac53128cb37e5d4d11ed4f79ae94db08f72e252c3d66a8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WgYw.exe
            • Path C:\Users\Admin\AppData\Local\Temp\WgYw.exe
            • Size 1.6MB
            • SHA256 f27963dfb266bf08516a29efdf7e2795f869b8814c04294e3449ea322ca996a9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WoQq.exe
            • Path C:\Users\Admin\AppData\Local\Temp\WoQq.exe
            • Size 2.2MB
            • SHA256 3836ebb4ccab6f54950561ba17a7d5636957b5d9acd626b4c96ed40edeaee5e2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WwYG.exe
            • Path C:\Users\Admin\AppData\Local\Temp\WwYG.exe
            • Size 2.0MB
            • SHA256 623fa80dbcb2ce4d21ab4542f5d7386cab9962837616623c3f560f4b5db99d52
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Wwoa.exe
            • Path C:\Users\Admin\AppData\Local\Temp\Wwoa.exe
            • Size 2.3MB
            • SHA256 9a16552ca8b50c3f31f7f31e0d58329f8c61db4756d16f1a70cf0e70f1045b05
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            YEoS.exe
            • Path C:\Users\Admin\AppData\Local\Temp\YEoS.exe
            • Size 1.8MB
            • SHA256 6fefdb2e151eec257241af9b782016b0f7c0e8d09948abd7a2873d11876cb2d6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            YIMe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\YIMe.exe
            • Size 1.9MB
            • SHA256 e54493cf0d6dd2b5875a7a8f7bae6c0634cafa89696650b21b75aea854d743f8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            YsMM.exe
            • Path C:\Users\Admin\AppData\Local\Temp\YsMM.exe
            • Size 1.9MB
            • SHA256 cbcac020e40a3ed8c5ed15397a85852c2991e0c06960bb45fb5dd94efca0fd6a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            YsoG.exe
            • Path C:\Users\Admin\AppData\Local\Temp\YsoG.exe
            • Size 2.4MB
            • SHA256 42e78bd21c537828998a82311807e0eaf43655dde2800e6ff6e7035fe775298c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            aEsO.exe
            • Path C:\Users\Admin\AppData\Local\Temp\aEsO.exe
            • Size 1.7MB
            • SHA256 5e589ba267cf7280ed2e1ef7fe6ec1b30fa6320dedc1e84d071f381a046ab1c9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            aIsK.exe
            • Path C:\Users\Admin\AppData\Local\Temp\aIsK.exe
            • Size 2.3MB
            • SHA256 b01f80c3222dd3243de98279d8ae1ce226e4a45d78f9b58c7324e5de2b7090bb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            aMwq.exe
            • Path C:\Users\Admin\AppData\Local\Temp\aMwq.exe
            • Size 1.9MB
            • SHA256 0d315a7752831b82671ecaeb0d7f75aaad03270578bb2122b4fd90afbb85b869
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            aUAG.exe
            • Path C:\Users\Admin\AppData\Local\Temp\aUAG.exe
            • Size 1.7MB
            • SHA256 e6cba27827290dd3a91d8518f795f8c8f24aa7b67f6ee6b4f28f4016aadff88a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            aUgY.exe
            • Path C:\Users\Admin\AppData\Local\Temp\aUgY.exe
            • Size 1.6MB
            • SHA256 eb7acd95192a4c905e8b108562d6b5e7ef0b90dcd1c4369d7cce9a27d7b84a9c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            acwY.exe
            • Path C:\Users\Admin\AppData\Local\Temp\acwY.exe
            • Size 1.8MB
            • SHA256 ae5d214185288dea56387c01ff938a5b1fc4cfdafc899c559d91b2bfa324f4f0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            akMG.exe
            • Path C:\Users\Admin\AppData\Local\Temp\akMG.exe
            • Size 1.6MB
            • SHA256 610d76a4c8259e8594b2d7833ecfd677d2389b2f1c562ea165221f9ebb8e63a8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            asUO.exe
            • Path C:\Users\Admin\AppData\Local\Temp\asUO.exe
            • Size 2.1MB
            • SHA256 a6dba756859f58c20d09e47f76395ceb287a4f73036272ba6bcc54c33c8f2cb3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cIoQ.exe
            • Path C:\Users\Admin\AppData\Local\Temp\cIoQ.exe
            • Size 1.9MB
            • SHA256 3b6e174ffca0f3bdb7812b8788e5ff399b14ba1a551037fbffde195af36386d1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cQkm.exe
            • Path C:\Users\Admin\AppData\Local\Temp\cQkm.exe
            • Size 2.0MB
            • SHA256 732d609cd7e93b49bebe4686383fda69cf13ab56572bfcf7c6be204293c02024
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cYIY.exe
            • Path C:\Users\Admin\AppData\Local\Temp\cYIY.exe
            • Size 1.6MB
            • SHA256 64fb650d568925b5a6a16cdfea11e436e75c906f6d9ce45959f3b13cc50fff5c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cski.exe
            • Path C:\Users\Admin\AppData\Local\Temp\cski.exe
            • Size 2.1MB
            • SHA256 3351fe968259700fa78e65327a8ae22993fff61ee85c1a0b9465d0b1d367e28b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cssg.exe
            • Path C:\Users\Admin\AppData\Local\Temp\cssg.exe
            • Size 2.2MB
            • SHA256 e28de0a66151c17a91179088d739310e21c304dd9f956b94433ec3ae0bd164ed
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            eoQk.exe
            • Path C:\Users\Admin\AppData\Local\Temp\eoQk.exe
            • Size 2.2MB
            • SHA256 742b37a03a68108bcd3e7b31d82e33ef8658fd64f33e9faf747717c151199cb1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            euYg.ico
            • Path C:\Users\Admin\AppData\Local\Temp\euYg.ico
            • Size 4KB
            • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ewUW.exe
            • Path C:\Users\Admin\AppData\Local\Temp\ewUW.exe
            • Size 2.1MB
            • SHA256 0f58ebed5606bf67c5c9acc6413a152b9783e33f2cd486c0254d4797b7edd766
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ewsI.exe
            • Path C:\Users\Admin\AppData\Local\Temp\ewsI.exe
            • Size 1.9MB
            • SHA256 d8509579d19da166d396858717af128965195b36b4f73d0268e5b6dfc7ea753e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            file.vbs
            • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
            • Size 19B
            • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
            • MD5 SHA1 SHA512
            Submit Download

            gEwK.exe
            • Path C:\Users\Admin\AppData\Local\Temp\gEwK.exe
            • Size 2.0MB
            • SHA256 2e8b4f734bc7e9a23898e4004a0b8147496d9a3ca60bb04e36789cdb4ba2d130
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            gcUa.exe
            • Path C:\Users\Admin\AppData\Local\Temp\gcUa.exe
            • Size 2.0MB
            • SHA256 a12cfc676aa4930fe7118eab51df6c9d5fc51ccc6c62d2296757408d06a30a6b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ggQu.exe
            • Path C:\Users\Admin\AppData\Local\Temp\ggQu.exe
            • Size 1.6MB
            • SHA256 3856c306ae2d4b2cf88349a3af3a26e4becbdc33c6771c74bb5ba2381288f723
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            iksi.exe
            • Path C:\Users\Admin\AppData\Local\Temp\iksi.exe
            • Size 1.9MB
            • SHA256 382ea812c33330845ea266b4791969600ecbac4a240bd37c99e286f4f03e64b9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            kGMg.ico
            • Path C:\Users\Admin\AppData\Local\Temp\kGMg.ico
            • Size 4KB
            • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            kgAm.exe
            • Path C:\Users\Admin\AppData\Local\Temp\kgAm.exe
            • Size 1.6MB
            • SHA256 8fe24531a8f591c6099565196863f37f5b356ee5aa09d3a056c125959673158b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            kswK.exe
            • Path C:\Users\Admin\AppData\Local\Temp\kswK.exe
            • Size 2.2MB
            • SHA256 dc0a400fa85e02cdbcafb71a5becc7dd4f9c3cf9dd4160793b3c2f4872404886
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mMIA.exe
            • Path C:\Users\Admin\AppData\Local\Temp\mMIA.exe
            • Size 1.6MB
            • SHA256 46b88c422227d1ed9a1f5749f40614d220b388f01d4957d3c14f764166d0d916
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mQkm.exe
            • Path C:\Users\Admin\AppData\Local\Temp\mQkm.exe
            • Size 1.6MB
            • SHA256 7484fc816b64e3b042e822391832753d3c27e42f4b7133271700ee62a6976d13
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mYwq.exe
            • Path C:\Users\Admin\AppData\Local\Temp\mYwq.exe
            • Size 1.6MB
            • SHA256 3d5032bcf7b4aa2ff3c7ef75d62cec37f0b75b8debd6f3fcae394f3cf1d4f4ce
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mwso.exe
            • Path C:\Users\Admin\AppData\Local\Temp\mwso.exe
            • Size 1.6MB
            • SHA256 25b5de5524dd51f4b9349235cf3d9de94f4379ce95557bf948f11647ccb37d17
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            oAQy.exe
            • Path C:\Users\Admin\AppData\Local\Temp\oAQy.exe
            • Size 1.8MB
            • SHA256 f5b444212019c9506b3ef108c6ffcd242283f547c52569c6198b43e7d8b40fed
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            oQMG.exe
            • Path C:\Users\Admin\AppData\Local\Temp\oQMG.exe
            • Size 1.6MB
            • SHA256 7f82f6afa2dae127c619d217c7f998ef9cff8e0ae0c4fcd7c477ad237a7d0587
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            oYIe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\oYIe.exe
            • Size 1.7MB
            • SHA256 394ab3b96d961c25b63cad5397aa30cbdb48e744b6cd59d88e7d80cb3ee35206
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            osoA.exe
            • Path C:\Users\Admin\AppData\Local\Temp\osoA.exe
            • Size 1.9MB
            • SHA256 87e74fb5386a1d2d38874213bdd4e4b9ac3d6c9b1ddd9b5cd700bda0cfeeb9d3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            qIom.exe
            • Path C:\Users\Admin\AppData\Local\Temp\qIom.exe
            • Size 2.6MB
            • SHA256 b49f91f7dbd0becb086816e017d1b88794292850d9b1e3be57601e1278647442
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            qUQc.exe
            • Path C:\Users\Admin\AppData\Local\Temp\qUQc.exe
            • Size 1.6MB
            • SHA256 6412c98e64fcd0f847a9c6c0d0ffbe663680d3e7794697573df56a7102222d26
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            qkgs.exe
            • Path C:\Users\Admin\AppData\Local\Temp\qkgs.exe
            • Size 1.6MB
            • SHA256 35799447f8643fc212462632e3623dbefbd2c1f3531e302dded20bd1deb4fdd5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sAEE.exe
            • Path C:\Users\Admin\AppData\Local\Temp\sAEE.exe
            • Size 1.9MB
            • SHA256 6d25a052801c23bc7967fa7130961a0eebdca77b51fd09a90c822e361de5f8ef
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sAUU.exe
            • Path C:\Users\Admin\AppData\Local\Temp\sAUU.exe
            • Size 1.6MB
            • SHA256 2718cb99ca2bf2bdd57b5a51415f56ae68e85dcc4f3b128d3e145cebfc17a8c7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sAga.exe
            • Path C:\Users\Admin\AppData\Local\Temp\sAga.exe
            • Size 2.0MB
            • SHA256 805ddbdca205e5be25b4a5577ccd4f62beb2b481132abd039d06ba9caba5650a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            uAAM.ico
            • Path C:\Users\Admin\AppData\Local\Temp\uAAM.ico
            • Size 4KB
            • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            uAwC.exe
            • Path C:\Users\Admin\AppData\Local\Temp\uAwC.exe
            • Size 1.6MB
            • SHA256 2d0514919267f88830215eff2c468492a0abe12934774eb9c2108e70a56048da
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            uMgs.exe
            • Path C:\Users\Admin\AppData\Local\Temp\uMgs.exe
            • Size 1.6MB
            • SHA256 461a6db911ea24c292b174fc42a00dee6a69419528c1b1839090f17e46393581
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ugAU.exe
            • Path C:\Users\Admin\AppData\Local\Temp\ugAU.exe
            • Size 1.6MB
            • SHA256 7b9a583d95d614d22d35f5141078e1a261415e7dcebf71e0d1d2ff05241e7e3b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            usse.exe
            • Path C:\Users\Admin\AppData\Local\Temp\usse.exe
            • Size 1.8MB
            • SHA256 228da6d9566406552966623b03cacff65863e9896d632234d2a7ee2b166928d5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wUMO.exe
            • Path C:\Users\Admin\AppData\Local\Temp\wUMO.exe
            • Size 2.0MB
            • SHA256 b908bc7644c2b0192306d689cb4018ce8ecdd3f91d3da6984eb7b75cd213173c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wUgo.exe
            • Path C:\Users\Admin\AppData\Local\Temp\wUgo.exe
            • Size 2.6MB
            • SHA256 683056166407f54a22eb855f6afd8752b349e7322eaf8582f66702de82e8dfed
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wksu.exe
            • Path C:\Users\Admin\AppData\Local\Temp\wksu.exe
            • Size 1.6MB
            • SHA256 e7e99825e31f94951228489e7eaec7d7d5b76c7c4bb858575b636de7e78149f1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wokM.exe
            • Path C:\Users\Admin\AppData\Local\Temp\wokM.exe
            • Size 1.6MB
            • SHA256 82b6f03ce377b1309c82ee59d146bf2c3982eb70247d27930a151ed412d42641
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            yUUA.exe
            • Path C:\Users\Admin\AppData\Local\Temp\yUUA.exe
            • Size 1.7MB
            • SHA256 d643e698f5145dff8fe20f881378ab2d51ecd84317198e5627c8ef3524382b8c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            yYMY.exe
            • Path C:\Users\Admin\AppData\Local\Temp\yYMY.exe
            • Size 1.8MB
            • SHA256 52682a4153b3d953c67c58f255c897078a3a9df8a8157cb88e95618813634621
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ykMo.exe
            • Path C:\Users\Admin\AppData\Local\Temp\ykMo.exe
            • Size 2.2MB
            • SHA256 9264517590c5f7e7df8aeee3439f7774d15c1808531d6f586ca8f9a9858ae1c3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ywYs.exe
            • Path C:\Users\Admin\AppData\Local\Temp\ywYs.exe
            • Size 3.1MB
            • SHA256 351275f1e9554f4e451afee24c204666cdfa62539da6399e1b973433d7dab242
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nEkswUAE.exe
            • Path C:\Users\Admin\zagkoMgE\nEkswUAE.exe
            • Size 1.6MB
            • SHA256 5ecde088d990921b7f948e452df07e85f3247863c37d43c7a60396327310020e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nEkswUAE.inf
            • Path C:\Users\Admin\zagkoMgE\nEkswUAE.inf
            • Size 4B
            • SHA256 709c434d8b8acb1acf60061f00934c1f937bc1173fedb142bf223aee921886eb
            • MD5 SHA1 SHA512
            Submit Download

            nEkswUAE.inf
            • Path C:\Users\Admin\zagkoMgE\nEkswUAE.inf
            • Size 4B
            • SHA256 888985dd6ce6673b7e0a80d736bae552ad3f2397e7737b01d7c4f72c130228ce
            • MD5 SHA1 SHA512
            Submit Download

            memory/916-51-0x0000000000400000-0x00000000005F2000-memory.dmp
            Download

            memory/916-65-0x0000000000400000-0x00000000005F2000-memory.dmp
            Download

            memory/1104-152-0x0000000000400000-0x00000000005F2000-memory.dmp
            Download

            memory/1312-1779-0x0000000000400000-0x0000000000590000-memory.dmp
            Download

            memory/1752-164-0x0000000000400000-0x00000000005F2000-memory.dmp
            Download

            memory/2480-1770-0x0000000000400000-0x0000000000590000-memory.dmp
            Download

            memory/2480-33-0x0000000000400000-0x0000000000590000-memory.dmp
            Download

            memory/2720-50-0x0000000000400000-0x00000000005F2000-memory.dmp
            Download

            memory/3160-182-0x0000000000400000-0x00000000005F2000-memory.dmp
            Download

            memory/3308-1555-0x00000000021E0000-0x0000000002200000-memory.dmp
            Download

            memory/3308-1755-0x0000000000400000-0x0000000000590000-memory.dmp
            Download

            memory/3308-228-0x00000000021E0000-0x0000000002200000-memory.dmp
            Download

            memory/3308-7-0x0000000000400000-0x0000000000590000-memory.dmp
            Download

            memory/3444-30-0x0000000000400000-0x00000000005F2000-memory.dmp
            Download

            memory/3444-31-0x0000000002390000-0x00000000023B0000-memory.dmp
            Download

            memory/3444-1-0x0000000002390000-0x00000000023B0000-memory.dmp
            Download

            memory/3444-0-0x0000000000400000-0x00000000005F2000-memory.dmp
            Download

            memory/3544-77-0x0000000000400000-0x00000000005F2000-memory.dmp
            Download

            memory/3988-108-0x0000000000400000-0x00000000005F2000-memory.dmp
            Download

            memory/4296-120-0x0000000000400000-0x00000000005F2000-memory.dmp
            Download

            memory/4376-196-0x0000000000400000-0x00000000005F2000-memory.dmp
            Download

            memory/4636-138-0x0000000000400000-0x00000000005F2000-memory.dmp
            Download

            memory/4964-1760-0x0000000000400000-0x0000000000590000-memory.dmp
            Download

            memory/4964-16-0x0000000000400000-0x0000000000590000-memory.dmp
            Download

            memory/4976-208-0x0000000000400000-0x00000000005F2000-memory.dmp
            Download

            memory/5196-22-0x0000000000400000-0x0000000000590000-memory.dmp
            Download

            memory/5196-1765-0x0000000000400000-0x0000000000590000-memory.dmp
            Download

            memory/5544-1792-0x0000000000400000-0x00000000005F2000-memory.dmp
            Download