nabucur | 01cabba55512352ff26c101c5274046660ff4c4ddc5dff6d6e9f9d86c255bbe2

Analysis

max time kernel
150s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
Size 1.6MB
Sample260813-vbexdattay
SHA256 01cabba55512352ff26c101c5274046660ff4c4ddc5dff6d6e9f9d86c255bbe2
MD5 3f78fd65d14340b2ca8b576edbf4134d
SHA1 8e10a743012e2792952637aa1ca520167c1afd82
SHA512 9405fb4b0286207a0fa3b2a2cd3095e1dacf49694fb40915f496d8c479142bfbd1195d9a85051306afc507af20b9782d3f79d9b33152c10391123061f3390448
SSDEEP 12288:veqwmb27fBLjYOZvfl8b7MlwM9cU3M+gRSje5HeO+/pHaPv+F/f6fOp5:vtP8fBYOZHloMlf9D3d4eOHDa6veyfC
TLSH
T1A975BA87488D3248AEAA42224F8500D07237D9C29DFBE87FA36717796DF5A57DC8061F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution nabucur persistence ransomware spyware stealer trojan

Malware Config

Signatures

Family: Nabucur
Nabucur is a ransomware first seen in 2015.
ransomware nabucur

Modifies visibility of file extensions in Explorer 2 TTPs 20 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe

UAC bypass 3 TTPs 20 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Renames multiple (104) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 5 IoCs

pid	Process
4788	qmoAEoAY.exe
5988	nqgwcUUI.exe
1496	lQIAYcEw.exe
2812	nqgwcUUI.exe
1508	qmoAEoAY.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nqgwcUUI.exe = "C:\\ProgramData\\busMAMUk\\nqgwcUUI.exe"	nqgwcUUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\qmoAEoAY.exe = "C:\\Users\\Admin\\hmIcYoUU\\qmoAEoAY.exe"	qmoAEoAY.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\qmoAEoAY.exe = "C:\\Users\\Admin\\hmIcYoUU\\qmoAEoAY.exe"	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nqgwcUUI.exe = "C:\\ProgramData\\busMAMUk\\nqgwcUUI.exe"	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\qmoAEoAY.exe = "C:\\Users\\Admin\\hmIcYoUU\\qmoAEoAY.exe"	qmoAEoAY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nqgwcUUI.exe = "C:\\ProgramData\\busMAMUk\\nqgwcUUI.exe"	nqgwcUUI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nqgwcUUI.exe = "C:\\ProgramData\\busMAMUk\\nqgwcUUI.exe"	lQIAYcEw.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\hmIcYoUU	lQIAYcEw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\hmIcYoUU\qmoAEoAY	lQIAYcEw.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 20 IoCs

execution

Visual Basic

T1059.005

pid	Process
2880	cscript.exe
4280	cscript.exe
5212	cscript.exe
3916	cscript.exe
2104	cscript.exe
4348	cscript.exe
4592	cscript.exe
4728	cscript.exe
4068	cscript.exe
888	cscript.exe
696	cscript.exe
4624	cscript.exe
3884	cscript.exe
2776	cscript.exe
2880	cscript.exe
5584	cscript.exe
5668	cscript.exe
3772	cscript.exe
4776	cscript.exe
2564	cscript.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\AEcw.exe	nqgwcUUI.exe
File created	C:\Windows\SwwS.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\Uwci.exe	nqgwcUUI.exe
File created	C:\Windows\mgcy.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\wkQA.ico	nqgwcUUI.exe
File opened for modification	C:\Windows\aswe.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\gIIc.ico	nqgwcUUI.exe
File created	C:\Windows\aEoO.exe	nqgwcUUI.exe
File created	C:\Windows\GQUM.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\IsAg.ico	nqgwcUUI.exe
File opened for modification	C:\Windows\EwsE.ico	nqgwcUUI.exe
File opened for modification	C:\Windows\cIIw.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\OwIs.ico	nqgwcUUI.exe
File opened for modification	C:\Windows\OAcQ.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\AggY.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\QIEk.ico	nqgwcUUI.exe
File created	C:\Windows\QQoe.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\QQoe.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\wIUs.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\iooM.ico	nqgwcUUI.exe
File opened for modification	C:\Windows\sMgA.exe	nqgwcUUI.exe
File created	C:\Windows\AEcw.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\ouww.ico	nqgwcUUI.exe
File opened for modification	C:\Windows\WAYw.exe	nqgwcUUI.exe
File created	C:\Windows\YUoQ.exe	nqgwcUUI.exe
File created	C:\Windows\KAsK.exe	nqgwcUUI.exe
File created	C:\Windows\CoIC.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\Egge.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\kgUk.ico	nqgwcUUI.exe
File opened for modification	C:\Windows\KosC.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\QWwg.ico	nqgwcUUI.exe
File created	C:\Windows\aAIE.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\CugU.ico	nqgwcUUI.exe
File created	C:\Windows\uQku.exe	nqgwcUUI.exe
File created	C:\Windows\mQUg.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\wYAu.exe	nqgwcUUI.exe
File created	C:\Windows\MIEk.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\sUEq.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\YYEY.ico	nqgwcUUI.exe
File opened for modification	C:\Windows\UMgC.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\SmkM.ico	nqgwcUUI.exe
File opened for modification	C:\Windows\cYUk.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\SgUM.ico	nqgwcUUI.exe
File opened for modification	C:\Windows\eUQk.ico	nqgwcUUI.exe
File opened for modification	C:\Windows\cEoQ.ico	nqgwcUUI.exe
File opened for modification	C:\Windows\qYow.exe	nqgwcUUI.exe
File created	C:\Windows\SgIa.exe	nqgwcUUI.exe
File created	C:\Windows\WEQa.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\GYce.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\KAsK.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\EaQQ.ico	nqgwcUUI.exe
File created	C:\Windows\sEwi.exe	nqgwcUUI.exe
File created	C:\Windows\QQIq.exe	nqgwcUUI.exe
File created	C:\Windows\KUsO.exe	nqgwcUUI.exe
File created	C:\Windows\QwYE.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\WCAo.ico	nqgwcUUI.exe
File created	C:\Windows\wIUi.exe	nqgwcUUI.exe
File created	C:\Windows\CkQa.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\cQwU.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\eAMQ.ico	nqgwcUUI.exe
File opened for modification	C:\Windows\ymcE.ico	nqgwcUUI.exe
File created	C:\Windows\YowE.exe	nqgwcUUI.exe
File opened for modification	C:\Windows\omAQ.ico	nqgwcUUI.exe
File created	C:\Windows\sIIq.exe	nqgwcUUI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 40 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5460	cmd.exe
3188	cmd.exe
4784	cmd.exe
4064	cmd.exe
5944	cmd.exe
1336	cmd.exe
4704	cmd.exe
384	cmd.exe
5424	cmd.exe
2864	cmd.exe
3576	cmd.exe
3912	cmd.exe
2324	cmd.exe
2356	cmd.exe
5920	cmd.exe
5820	cmd.exe
4636	cmd.exe
1428	cmd.exe
1876	cmd.exe
5628	cmd.exe
2308	cmd.exe
1644	cmd.exe
4172	cmd.exe
5552	cmd.exe
1488	cmd.exe
5752	cmd.exe
5732	cmd.exe
6124	cmd.exe
1236	cmd.exe
1068	cmd.exe
3296	cmd.exe
432	cmd.exe
1184	cmd.exe
4192	cmd.exe
5760	cmd.exe
2960	cmd.exe
2800	cmd.exe
4968	cmd.exe
4836	cmd.exe
4840	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qmoAEoAY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qmoAEoAY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 60 IoCs

Modify Registry

T1112

pid	Process
3564	reg.exe
5932	reg.exe
4860	reg.exe
2240	reg.exe
5628	reg.exe
5856	reg.exe
4440	reg.exe
4940	reg.exe
4916	reg.exe
3360	reg.exe
2964	reg.exe
2976	reg.exe
3812	reg.exe
1228	reg.exe
2880	reg.exe
5476	reg.exe
5688	reg.exe
3652	reg.exe
1140	reg.exe
6120	reg.exe
4348	reg.exe
2084	reg.exe
2460	reg.exe
3928	reg.exe
4152	reg.exe
5732	reg.exe
2112	reg.exe
4472	reg.exe
4644	reg.exe
2004	reg.exe
4564	reg.exe
5580	reg.exe
4248	reg.exe
1340	reg.exe
2416	reg.exe
2084	reg.exe
5224	reg.exe
5604	reg.exe
2092	reg.exe
3192	reg.exe
3180	reg.exe
4400	reg.exe
1788	reg.exe
5728	reg.exe
752	reg.exe
4532	reg.exe
300	reg.exe
748	reg.exe
4556	reg.exe
5744	reg.exe
2432	reg.exe
4988	reg.exe
4556	reg.exe
5484	reg.exe
5324	reg.exe
4828	reg.exe
1336	reg.exe
1684	reg.exe
3444	reg.exe
3576	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4796	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
4796	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
4796	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
4796	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
5700	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
5700	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
5700	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
5700	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
2468	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
2468	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
2468	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
2468	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
4924	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
4924	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
4924	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
4924	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
4184	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
4184	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
4184	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
4184	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
2204	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
2204	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
2204	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
2204	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
1964	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
1964	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
1964	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
1964	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
5976	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
5976	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
5976	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
5976	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
1352	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
1352	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
1352	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
1352	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
3740	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
3740	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
3740	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
3740	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
4164	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
4164	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
4164	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
4164	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
1752	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
1752	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
1752	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
1752	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
2292	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
2292	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
2292	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
2292	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
4812	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
4812	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
4812	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
4812	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
2764	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
2764	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
2764	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
2764	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
1200	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
1200	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
1200	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
1200	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
2812	nqgwcUUI.exe
2812	nqgwcUUI.exe
2812	nqgwcUUI.exe
2812	nqgwcUUI.exe
2812	nqgwcUUI.exe
2812	nqgwcUUI.exe
2812	nqgwcUUI.exe
2812	nqgwcUUI.exe
2812	nqgwcUUI.exe
2812	nqgwcUUI.exe
2812	nqgwcUUI.exe
2812	nqgwcUUI.exe
2812	nqgwcUUI.exe
2812	nqgwcUUI.exe
2812	nqgwcUUI.exe
2812	nqgwcUUI.exe
2812	nqgwcUUI.exe
2812	nqgwcUUI.exe
2812	nqgwcUUI.exe
2812	nqgwcUUI.exe
2812	nqgwcUUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 4788	4796	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	89
PID 4796 wrote to memory of 5988	4796	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	90
PID 4796 wrote to memory of 384	4796	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	95
PID 4796 wrote to memory of 3928	4796	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	97
PID 4796 wrote to memory of 2432	4796	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	98
PID 4796 wrote to memory of 4828	4796	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	99
PID 4796 wrote to memory of 1184	4796	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	100
PID 384 wrote to memory of 5700	384	cmd.exe	107
PID 1184 wrote to memory of 696	1184	cmd.exe	108
PID 5700 wrote to memory of 2356	5700	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	109
PID 2356 wrote to memory of 2468	2356	cmd.exe	112
PID 5700 wrote to memory of 2084	5700	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	270
PID 5700 wrote to memory of 1140	5700	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	113
PID 5700 wrote to memory of 3576	5700	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	265
PID 5700 wrote to memory of 2960	5700	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	115
PID 2468 wrote to memory of 4172	2468	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	120
PID 2960 wrote to memory of 4624	2960	cmd.exe	122
PID 2468 wrote to memory of 5856	2468	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	123
PID 2468 wrote to memory of 5628	2468	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	271
PID 2468 wrote to memory of 2240	2468	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	202
PID 2468 wrote to memory of 6124	2468	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	126
PID 4172 wrote to memory of 4924	4172	cmd.exe	131
PID 6124 wrote to memory of 5668	6124	cmd.exe	278
PID 4924 wrote to memory of 2800	4924	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	133
PID 2800 wrote to memory of 4184	2800	cmd.exe	135
PID 4924 wrote to memory of 4440	4924	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	136
PID 4924 wrote to memory of 3180	4924	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	137
PID 4924 wrote to memory of 4988	4924	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	138
PID 4924 wrote to memory of 5920	4924	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	139
PID 5920 wrote to memory of 4348	5920	cmd.exe	327
PID 4184 wrote to memory of 5820	4184	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	145
PID 5820 wrote to memory of 2204	5820	cmd.exe	147
PID 4184 wrote to memory of 748	4184	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	148
PID 4184 wrote to memory of 4472	4184	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	226
PID 4184 wrote to memory of 2880	4184	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	335
PID 4184 wrote to memory of 1236	4184	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	151
PID 2204 wrote to memory of 5460	2204	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	156
PID 2204 wrote to memory of 4556	2204	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	234
PID 2204 wrote to memory of 2976	2204	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	159
PID 2204 wrote to memory of 2964	2204	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	160
PID 2204 wrote to memory of 3188	2204	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	161
PID 1236 wrote to memory of 3772	1236	cmd.exe	162
PID 5460 wrote to memory of 1964	5460	cmd.exe	167
PID 3188 wrote to memory of 4776	3188	cmd.exe	168
PID 1964 wrote to memory of 4968	1964	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	169
PID 4968 wrote to memory of 5976	4968	cmd.exe	171
PID 1964 wrote to memory of 4152	1964	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	172
PID 1964 wrote to memory of 5728	1964	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	173
PID 1964 wrote to memory of 5484	1964	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	174
PID 1964 wrote to memory of 4192	1964	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	175
PID 5976 wrote to memory of 5552	5976	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	180
PID 4192 wrote to memory of 4280	4192	cmd.exe	320
PID 5976 wrote to memory of 3564	5976	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	183
PID 5976 wrote to memory of 752	5976	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	254
PID 5976 wrote to memory of 6120	5976	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	185
PID 5976 wrote to memory of 1068	5976	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	186
PID 5552 wrote to memory of 1352	5552	cmd.exe	191
PID 1068 wrote to memory of 3884	1068	cmd.exe	192
PID 1352 wrote to memory of 4636	1352	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	193
PID 4636 wrote to memory of 3740	4636	cmd.exe	195
PID 1352 wrote to memory of 5476	1352	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	196
PID 1352 wrote to memory of 4644	1352	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	197
PID 1352 wrote to memory of 1336	1352	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	313
PID 1352 wrote to memory of 5760	1352	2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe	199

C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\hmIcYoUU\qmoAEoAY.exe
  "C:\Users\Admin\hmIcYoUU\qmoAEoAY.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4788
- C:\ProgramData\busMAMUk\nqgwcUUI.exe
  "C:\ProgramData\busMAMUk\nqgwcUUI.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:5988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:384
- - C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5700
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2468
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock"
        8⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock"
        10⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock
        11⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock"
        12⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock
        13⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock"
        14⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock
        15⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock"
        16⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock
        17⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock"
        18⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock
        19⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock"
        20⤵
        Executes a command shell one-liner
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock
        21⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock"
        22⤵
        Executes a command shell one-liner
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock
        23⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1752
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock"
        24⤵
        Executes a command shell one-liner
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock
        25⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock"
        26⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock
        27⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock"
        28⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:432
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        29⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock
        29⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock"
        30⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock
        31⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock"
        32⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3912
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        33⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock
        33⤵
        System Location Discovery: System Language Discovery
        
        PID:2692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock"
        34⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock
        35⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock"
        36⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1876
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        37⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock
        37⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock"
        38⤵
        Executes a command shell one-liner
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock
        39⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock"
        40⤵
        Executes a command shell one-liner
        
        PID:4840
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        40⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1788
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        40⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4348
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        40⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RasQUsEE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe""
        40⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4704
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        41⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5584
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        38⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:3360
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        39⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        38⤵
        Modifies registry key
        
        PID:5604
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        38⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\scAkIYEA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe""
        38⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2324
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        39⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:2880
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        36⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4916
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        36⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2112
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        36⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DWwokwUc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe""
        36⤵
        Executes a command shell one-liner
        
        PID:5732
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        37⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:2776
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        34⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1228
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        34⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1340
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        34⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\smIowAEA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe""
        34⤵
        Executes a command shell one-liner
        
        PID:5752
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        35⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:2104
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        32⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5324
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        32⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5744
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        32⤵
        UAC bypass
        Modifies registry key
        
        PID:5932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UKMUYYQU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe""
        32⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2308
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        33⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:2880
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        30⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:3812
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        30⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4400
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        30⤵
        UAC bypass
        Modifies registry key
        
        PID:2084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SsQAEUYE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe""
        30⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5628
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        31⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:2564
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        28⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:300
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        28⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4248
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        28⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NwMscgQM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe""
        28⤵
        Executes a command shell one-liner
        
        PID:5944
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        29⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:888
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        26⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4532
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        26⤵
        Modifies registry key
        
        PID:2460
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        26⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fKcoIcEM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe""
        26⤵
        Executes a command shell one-liner
        
        PID:4064
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        27⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3916
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        24⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:5580
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        24⤵
        Modifies registry key
        
        PID:2416
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        24⤵
        UAC bypass
        Modifies registry key
        
        PID:4556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tegwEsoc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe""
        24⤵
        Executes a command shell one-liner
        
        PID:2864
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        25⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:5212
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        22⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:5688
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        22⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4564
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        22⤵
        UAC bypass
        Modifies registry key
        
        PID:2092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AmwkwUgQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe""
        22⤵
        Executes a command shell one-liner
        
        PID:4836
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        23⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        23⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4068
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        20⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1684
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        20⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4940
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        20⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CgIcUQIg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe""
        20⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5424
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        21⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:4728
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        18⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5476
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        18⤵
        Modifies registry key
        
        PID:4644
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        18⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CScMYAoE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe""
        18⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        19⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        19⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4592
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        16⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3564
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        16⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:752
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        16⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:6120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rYMAEAkw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe""
        16⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1068
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        17⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3884
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        14⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4152
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        14⤵
        Modifies registry key
        
        PID:5728
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        14⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5484
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PUogUIko.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe""
        14⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4192
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        15⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:4280
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        12⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4556
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        12⤵
        Modifies registry key
        
        PID:2976
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        12⤵
        UAC bypass
        Modifies registry key
        
        PID:2964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UuokAgsw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe""
        12⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3188
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        13⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4776
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        10⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:748
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        10⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4472
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        10⤵
        UAC bypass
        Modifies registry key
        
        PID:2880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OkwYooUc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe""
        10⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1236
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        11⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3772
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        8⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4440
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        8⤵
        Modifies registry key
        
        PID:3180
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        8⤵
        UAC bypass
        Modifies registry key
        
        PID:4988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MAEAQEwk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe""
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5920
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        9⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4348
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        6⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:5856
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        6⤵
        Modifies registry key
        
        PID:5628
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        6⤵
        UAC bypass
        Modifies registry key
        
        PID:2240
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pusIUgww.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:6124
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5668
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies registry key
      PID:2084
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1140
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3576
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\heUQUMEI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe""
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2960
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4624
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies visibility of file extensions in Explorer
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:3928
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  - Modifies registry key
  PID:2432
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - UAC bypass
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:4828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WEccoAIo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock.exe""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:696

C:\ProgramData\jAMMkkEc\lQIAYcEw.exe
C:\ProgramData\jAMMkkEc\lQIAYcEw.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1496

C:\ProgramData\busMAMUk\nqgwcUUI.exe
C:\ProgramData\busMAMUk\nqgwcUUI.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
PID:2812

C:\Users\Admin\hmIcYoUU\qmoAEoAY.exe
C:\Users\Admin\hmIcYoUU\qmoAEoAY.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bmEM.txt

Path C:\ProgramData\bmEM.txt
Size 9KB
SHA256 cdba811bb5ef7f92177cccf22e3f2ce57adc052d1371d7eb49a60c20815e0964
MD5 de8f2f18d70422b6e3ceb131c90282df
SHA1 a4278d0e60b2b018d4a00207b7525a29831cf1a0
SHA512 0179dc7b85bea2fac6962d99ddbd5ff1ed03061572486a88a9ef17c886d376bbcfceee68b90928487fe219f1d4facebc18137529de6746b77ed82590c09eae40
SSDEEP 48:U563KS01Cys3KSwM3KSqk3KSjM83vE1Cys3vzMUXqY:XKS01MKSjKSpKSjfvE1Mvj
TLSH
T1EF129F312AE8067FFBBB55B183F10C716D27F8522A14CC8EA075424A4476E869DD0F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nqgwcUUI.exe

Path C:\ProgramData\busMAMUk\nqgwcUUI.exe
Size 1.6MB
SHA256 2519507308c2b5dc06d328064c588d327d9681710152af5382b7655e6b3f6725
MD5 02e6452ad9f5b967277999639789c978
SHA1 3e53c2c650965ba2840b0dbb64c47ff1436982f9
SHA512 3cfbbd7fe95b5ce9b14f9182fc9067caa74f5ca57820ec31577996c21c881a5ff646d89e5fed039bf2a9a3637abb35dac70da28153f7b637ad05e9545578877f
SSDEEP 12288:TFcXsO5ZGu4ff0isUvDuxkIc+ABXiSfWOB1JKvycHhE/u/3EhThdiKvKnaYxF:TFcXFmf0mvyhc+udfWJodvKn3x
TLSH
T17F75EE17A74CDAC05C9DC4DE272D177A2995BE2C4BDDCF2E84AB5CD0838AF238585236
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nqgwcUUI.inf

Path C:\ProgramData\busMAMUk\nqgwcUUI.inf
Size 4B
SHA256 8c7310fe9845bf75d4223dbc52dedf95ed06ec2c177fd62bc11a7f54c0327bbd
MD5 1fc5f7baad8680b5be8c95bc7e7d67b2
SHA1 070bc8f4ee92b39181c696aede0f8dfe44d73940
SHA512 3e1bba8fb453456e45b62d48a666027086c057c9142b4c52f6ee9b1d36d9e51b5b14f0ed50425818c64ce8d23420cd196c8c0c0aec74448a6db06aef81a1edc6
MD5 SHA1 SHA512

Submit Download

lQIAYcEw.exe

Path C:\ProgramData\jAMMkkEc\lQIAYcEw.exe
Size 1.6MB
SHA256 6607ead83976ba34ac063c15171ed27444d34c6d25b62cd9c664890aef15e26f
MD5 540159e6f28e7eaf11e5d6e395713e42
SHA1 dbc637f8c373060d4bf447f48cdb783ddc5ed7da
SHA512 2be235c9a4d79c95c0bb43ab40414b00c5f244d2bebf7e2021022dcf560f08dc08cd9279693bf336d5c6c3259616ec757164998774b29571557323f42d3c6955
SSDEEP 12288:XcXPKph2F91ofGXR5srsLiPnym5W46bsd3Pg9VkQMV:XcQhf7FU43Pg1
TLSH
T1687558CB653CDBB0700D49B8DB5AD48B4A611938C7F10F8299CB88745E6EDC7A94C27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock

Path C:\Users\Admin\AppData\Local\Temp\2026-08-13_3f78fd65d14340b2ca8b576edbf4134d_elex_virlock
Size 38KB
SHA256 0f35ace5268db33940ed18e946a9c65be4e31ec0ae31faa6e60122859c5cb5ca
MD5 45b3b7ada6575d1623bd52d029d7cf96
SHA1 ae4810a660e18d7e40594d1e8e0fe33b46a7f2a4
SHA512 c7d39db201687940bcbf8e3afb90becf5389640d7948e0cf3518bfae98fda1496650fa59a490631fcad894a9aa0f3d78e4d8b5bb9df57812abbc010c638926a8
SSDEEP 768:935RFO1NmgxH4WD6bK72pizILEF7P4ieb0MCquyQ6trGJipd9yS/xkXoZiHZmgi3:No1NtJ4WGb/i8LOPLeAJft6trwioowKz
TLSH
T11F03F1DBC218C23FA6CCD271CE572E486B6F42AE5426C9781F67C725005642B4ABB894
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WEccoAIo.bat

Path C:\Users\Admin\AppData\Local\Temp\WEccoAIo.bat
Size 112B
SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
MD5 bae1095f340720d965898063fede1273
SHA1 455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA512 4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
TLSH
T12DB0924C2C8880FC0D108E82881CC42AF1CCC0C1C394401AA0A30688E33CEA89ED6AC6
MD5 SHA1 SHA512 TLSH

Submit Download

file.vbs

Path C:\Users\Admin\AppData\Local\Temp\file.vbs
Size 19B
SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
MD5 4afb5c4527091738faf9cd4addf9d34e
SHA1 170ba9d866894c1b109b62649b1893eb90350459
SHA512 16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
MD5 SHA1 SHA512

Submit Download

qmoAEoAY.exe

Path C:\Users\Admin\hmIcYoUU\qmoAEoAY.exe
Size 1.6MB
SHA256 e0d005d9c2573ffd31543f0d24d3f157ac27723214ce5f649c9c29639a375a8c
MD5 f0740a95842ba1efb2641517ddda6319
SHA1 f4eb2ef1b64ee5804b603cc2da0fa8e0afd88b73
SHA512 8e03c7933b30185c950dd37395f4830b058088b9580086e8528857980c8d2fe1619418bfaa4b80363b38f1629c33e540e94ed11c695b5c3c3b88d243f43d3907
SSDEEP 24576:kI3h5Q+WYBA5NfuNv6YJQTPL+vzYwMqYVGfKMi8xGLya:Fx5/eqvVa3CMqYNM9xGL
TLSH
T1FF75FF61942E2B3EACCF9642CF6177662958EB723170CFBC14BC598C81898F750A1D9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qmoAEoAY.inf

Path C:\Users\Admin\hmIcYoUU\qmoAEoAY.inf
Size 4B
SHA256 b4687e9bbea6c246cacab459d77cce8b3fec5583447d6be5ef234713f827aa1f
MD5 75f11bafacaae8e1daa669591271d629
SHA1 42c6c9ff9fcffdef74849cf7e68fc48cc2d10473
SHA512 5f5f435f803ba300d77c9a4dd38fb8d2267962eca6b497f6b127c4c3550ca7f41fa666fcaed7e2a0d88c100b76110f6d248c76b72442dc72498081347cdbaa1c
MD5 SHA1 SHA512

Submit Download

qmoAEoAY.inf

Path C:\Users\Admin\hmIcYoUU\qmoAEoAY.inf
Size 4B
SHA256 7941e0bd80d793406e1b5eea65711b2f9b43c6002a031f9dcf111c05e8be5be8
MD5 74f4a143e59e7000bbcaba664714adae
SHA1 a41182d955b30f47105d936a57c26671ef04559a
SHA512 598e27b6ea922765643f77da3416985520ba0c9533e5812d92a02900b596c9ae72cccd5d45e14998ada34bd2320a85d331a109b476d2fb01b993977edbe57637
MD5 SHA1 SHA512

Submit Download

qmoAEoAY.inf

Path C:\Users\Admin\hmIcYoUU\qmoAEoAY.inf
Size 4B
SHA256 a87fe61c56249e462f9d89e988f524c98d578c5cfbea5c73cf5461511411b0ff
MD5 b8785778e1f92ee25d75f5f0db4aca20
SHA1 ff095ad73c187da407d87c923c477d04475a88d1
SHA512 6a2464ca711d5e1c0171123a5d82937fc88c9c16d4f7d629c842ee033992e83036ea65492dbb953790ec723ab13330ca7baeb2c5649dc2a6851dadf0151856fd
MD5 SHA1 SHA512

Submit Download

qmoAEoAY.inf

Path C:\Users\Admin\hmIcYoUU\qmoAEoAY.inf
Size 4B
SHA256 454e470347c9c2d2d0f4bff11d42cfb995e86a900e400f111682f224dec67810
MD5 da6808b0839d26e0379a8a9677fcbd67
SHA1 f871566bc832cd7dbb96ed6c32de82eb2d56e328
SHA512 9cb80beac31f07a811fcd05b49c0397e3111b4c5218c486f952e1e3f077d25402cb77eb7097a14a15c93485216bfbefbea000beca6ab970f7cfe96965f4abbb9
MD5 SHA1 SHA512

Submit Download

qmoAEoAY.inf

Path C:\Users\Admin\hmIcYoUU\qmoAEoAY.inf
Size 4B
SHA256 ba10d1fa944c72a8644b05fc62d29ba6cab6816fa0a14fd8fb5cd01c7f9df0df
MD5 1051c5ab541d49b8bbd67fbf48fbee99
SHA1 93963a139e68bee2fce9dc29b09078277292b56c
SHA512 760ac30beb89353d88fa38542622ef939eda0ab122dedb9bbd34ae7ca7e27586b46ae8e89cc96a2580d9dda42ebaaac0bf9c349f07602a5fd729ea357fb603ad
MD5 SHA1 SHA512

Submit Download

AEcw.exe

Path C:\Windows\AEcw.exe
Size 2.1MB
SHA256 e236875aa43b3d4cc1c9818fa5fc1690542ea12857635a826bf9f0643a2880ac
MD5 0f453df39bc21f3675eba1fe3aeaab41
SHA1 cf8e3c807627e52bb39c1c31b8a35118ce62e97d
SHA512 35921b776232a8878691561b063a779e783317de8569503ea5310bb2d836c1e80bdd21f88fcbff99940f12c7d5785bc6e1b5731f0df6c9563d6bed904bffa1c7
SSDEEP 24576:EcV3UYHyfVB5rch2cmCB/4HI0N+N47Lsh/a3p/Fp4yWOe:EcV3hS9BJdFCB/4HI0N+NoLsGp/FpIO
TLSH
T180A5723BE9490B928092A5FAC9F5147D8404602924DDD39B863E8C75B8BCC65BCFCE77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AUoU.exe

Path C:\Windows\AUoU.exe
Size 1.6MB
SHA256 20eb7c667c08990aed0ed9ab2d7ed0ac87f1df777d0f4ec8d27ff4bc23a95383
MD5 bf8d96a98a550fbba7ba8a94e91c1166
SHA1 a7aafaa6146fb68a3d4e995768d4f825ccf11e7a
SHA512 f710a21c01a1f56e922246ff10105b2e4c5ce6037d9085864712d19db67147df67e8a2de7e32fdee76a0ad5dc0092949b5b4e93379c7012a206d291b1268aa29
SSDEEP 24576:C78kHX3WpQ0EI7geLnin0pXn3nPyHwmR3wCvCqXL/h2fMbSIynwbvRWp3K+eRCyI:CHbRP/+6jqyjG+9BxM
TLSH
T17D759CCE1A778CFF1F83C188ECA71D4908632B587BD4E9D4A548782DC5ABA288D15D4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AggY.exe

Path C:\Windows\AggY.exe
Size 1.6MB
SHA256 ffcd78a0d598e6b4ad8c2754f541bf158c591ccf74d3c5c9c5c08c0cbaa664d1
MD5 e3393219de7c6578e407da5cfc2a4823
SHA1 e98e7c9d7271a399377921f2dfb127f21c64b527
SHA512 9d718162563be63770bc6f56b7d244f9388d286df4e11d3f0e3a5954959a5b74be22779eca8a4decb1a6ef121636e46fa7968a65d0ebd3b44ea58ef0f976139d
SSDEEP 12288:rWW3audt8y3B2JYx30yev8vMejjrkEskgiWruASWaZmzk:fb8yx2il0Lv5ijrD0iWruAaZmQ
TLSH
T1FF7575A6F1EF9093EA47AB7A99435E0DA901ABBCC26D150754C03B3ECF930653E1ED50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CIYM.exe

Path C:\Windows\CIYM.exe
Size 1.6MB
SHA256 0d887243add96aaa0aa197f028a749be7ffb0654857323de147ce31116373098
MD5 ff890eb0a80c0c02c7f51c90fc02ccd3
SHA1 5c61e22ab3360c4fd044efda58beb9ca3bfc8cf7
SHA512 6ec0712b4a80866717f22ed77c969ed6551abd5129d2bee35ce496c63971f1cb7488a447c59cf71835c19d4b3dd01696a5c21dc0fab38b7927260d84768853d9
SSDEEP 49152:EEKDhkZgzYDEQILw1qDkayWjUhfzMo28lEPxn/bG/ohy+7Jypi:YbGwhy1Y
TLSH
T18975DB05DAE36CF7F52B9F671E402BD6D2F4E9894B27809008B75BBF83838749885794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CMgG.exe

Path C:\Windows\CMgG.exe
Size 2.0MB
SHA256 6c40b3c825cee4bf6ff6dd0c9dc334739cc1faa340ad8d006bdf1696992b0f42
MD5 37e835fd1e5955e32d669e4b90677492
SHA1 c7f5cdee52de02f58bc37f6db5538d63a1b111e7
SHA512 84986c2227eb82c837e3892c22ee5f41fb67560bd9a41b65de38cd8c6e9977dbb07f13d0b1c9411d116a901c52f093afb9c3648afeaa327e76f0010ef70a517d
SSDEEP 49152:A8EiuawKBR0XVHmYiDIh6Freh7uTcWNsn7oesshHVK8jSAh7PWT4z9:MXdRpVljSCX
TLSH
T1FBA53F8F7AFE845A30CD48432E5EF8AA8FF40DB49C939E5267911F593A42C47C16E2D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CQcg.exe

Path C:\Windows\CQcg.exe
Size 1.9MB
SHA256 26d57327d16ce86f333440e9aa89074a01d85ea049ed96928050596c18461729
MD5 85afd0f7589a28a190d4e1643a74aac1
SHA1 8a8995fec757869a5dc38bc4832623b2ddadff7d
SHA512 d5a66e62b60cf62de3f8006ee68f3062c72e9e8f42a2a1ecbb3499577281aad59d088682045a48ae4348ce66ca04862e2ae5571a2df231260d7f9b91e7808d4e
SSDEEP 49152:T3Kxlg3/kMhKB5H4maDMmLSPm9KDML99:Taxl0/Dhu5YmaDMmLx9KQh
TLSH
T111955E67D2953FDC141F18919B5EF18CE70CB933A09A8DC7C19AABECC1E82D69012776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CYAq.exe

Path C:\Windows\CYAq.exe
Size 2.0MB
SHA256 bb73cc5b77e791ea6e1b7b0d49d399c8f6e19f6bbef40c1804a66d0515777ab4
MD5 5ce7908da07250c2052f7be5febc9c5d
SHA1 715456712ef0448dd1d619967165589e74b70724
SHA512 3c6325276159972ebbc478bce5e5ed578255950f855368e903638e5512e4bece9ddbafc69f37eb6496295460b000288fea6d79a23969c02604ea4d7439740357
SSDEEP 49152:pACWYRianjeJGjejd6LK8GNr99t1U+WZ:cYRiaS8ejd6GPRU+W
TLSH
T1EAA5FC0CB318E1158DB83616D6A069EF34A7E6AE7C7B4933632939DC3868F0640F57E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CkQa.exe

Path C:\Windows\CkQa.exe
Size 1.9MB
SHA256 f8f546f1a1d7ced7383832d9fc95968dd069901cace138854ec615495445ceed
MD5 ecac3c4003ed52b39fb38caf2738da0b
SHA1 67ca496ac8e5bf77170e288bd2bdad4aae662a20
SHA512 6aba6870d3fff868581adbfcdbe3d01d0a6370c1f7fb3da4697b2b82e5d42b7d15331714d8c361a9ec9cbb3c174d97941535de63b7a911af92a466dc6ba020c0
SSDEEP 24576:FxcjTgt91y/zKZBF2/497qeeDL47x2ToNDD3rb:FOjTgPY/zW97mgFJD3rb
TLSH
T1439552335679BA0334D20712AF716578EA8D512EE79CF6173A803B04FFE8590E88F656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CkcC.exe

Path C:\Windows\CkcC.exe
Size 2.2MB
SHA256 a06a65d1ad64e4e219462c24a1c6b280f0cc1cc5159237fd82e8f7c59f0ce185
MD5 bf1e78a2ec5648576aaf4174206c7d28
SHA1 a7762f90448d9c0d910d3247ef8506028d044cfe
SHA512 4181f14ccdcdd12c13d86776f24f6ef8feaa60d4e4da7a30a50d29a9aa81a3d3f999af3e87094a706494decc00a926dbadae4e7fa15fa3aa0aa391b6657b6a3b
SSDEEP 49152:1HOidjm6N0UnSRYPJRllllxpt1tFpJBrvA7vwEoxG0:1HOo7xSRY4VoxG0
TLSH
T1E6A52ED43884CB7F26BC7D74BC89BF58E9C18684A94EDCA57F48D1122B9F1C5402E87A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoIC.exe

Path C:\Windows\CoIC.exe
Size 2.0MB
SHA256 b9dbf8f9b0c14eb01453a2eb19e42d3d1cdce087ad75c488acb206972b82590a
MD5 e598cc783b9b749c0e477f956c851006
SHA1 6d85ff79bb546faf0687a4dbd28319929a2892f7
SHA512 653db7b79d89cffb4512b0d67e359af77850e382b95c649ee56d6224681f2b2bd28e007b70383ac02292da90063a65fc3dfd506252f50efcdc54f705d541afd1
SSDEEP 24576:SS6CoIIQxZhj3BFTCkpCJvpC7TBT15ZBFplVAJutRPmG87V:SS6FIIEFGKCJvpCfBLZBFp3A4juGo
TLSH
T1BCA52FAE0F77E3D17E22329ACD1B541C915B0A6310A58758B0B3C5674FBCDC68ECAA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CwIO.exe

Path C:\Windows\CwIO.exe
Size 1.9MB
SHA256 3ac0cef4c9693d402e8a269772f1498d8c9b3133bcff6becefee79735d32849a
MD5 38bd3b2dc0a05ca5818c30a6bdb24672
SHA1 2acfd409584b41ba1452068deca08919e2e697dc
SHA512 a3bda375f71636b387fc5f0f72dede75cf30cd93a2101c03058ade2a3bd0f4fdeebed348e28c9e6843f862f0be9104b4c153496309ab347eb4849da7a6df3c7b
SSDEEP 24576:Mk06nsTnIwmSBuYvz8WgSYiuJti7rlb6R3ozdjHbiGOVPp:aEQnIwmSBuYvz8WTYfE5ke9iBV
TLSH
T1F295E8CC3D61944E9F69C0DF17DC2618DE4C1363AEAE4A121D9AF439B12775BBE84B08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Egge.exe

Path C:\Windows\Egge.exe
Size 2.4MB
SHA256 34c50f64561901c7b770f917041a922c1704dec59fb7c45d52da82269d941adc
MD5 8e12dffaf392c46ef7ff25642d655059
SHA1 c5e956e7c6552981df05bf3edb897149bcbfc468
SHA512 40eca8c64e0b0f3065bc1646c478342479f0b888b9885cd8cb1fc091de7f680da3d002616161017cc6624f781d1867109e33586f7d4b19c0bfeb56f3d8400d2e
SSDEEP 24576:A4Z+nEUFxbHNO84W78bEz4h5N64N03w4FfgcT4x+7Bs3ZjRyEDw59mssCOcy+An/:d+EUjhBins3lhgZQAvyd/EznvWwG1
TLSH
T1B1C52B612C90C354720D3A7DFE5122DA3E0A4B7C751026FDA048DAB9A35DB2DD687AFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GAsa.exe

Path C:\Windows\GAsa.exe
Size 1.6MB
SHA256 8bbf8e783f97031fee09ffe5a0d92952c940a4f2b0d4289642423e7207afd54c
MD5 127e05650ed052f24c76ac2c1b983e61
SHA1 53d0a66128aa0976a435b81ff6504c8bc8157a02
SHA512 684890e7d1dc44288e5e1edaaa82a407d452d193034e9c635a7c07c23a3d86a2d26a4d42ed6a4fd5728ca1abbe0cae24eab0168f3a2b31ec3621716ccec9a948
SSDEEP 24576:Id/d9oN56WjNqULG/zz3MNYPezqh/Zy82MDSDz:IdC56WjwNzz3M6pDS
TLSH
T14775BB86CD1CB9A7477E4C72992FBD3F2FA2CCD079C32A5511646CC89DB042F666608B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GEIs.exe

Path C:\Windows\GEIs.exe
Size 2.0MB
SHA256 a621e98e4d03b5bdf336e4794248bdfb39ce751651a96d0abf80e24d649a282c
MD5 d7275c3b8a414b6e77b650463f91f6b3
SHA1 7f8208026236633abb0c789b587cbd73390148a8
SHA512 084b61ac115a200b6569d8d869e94cc2d9c2929ad2c5d04871d4e60d48f5f3c4968d6b8886850703fd3380b0be31a8418578d35db6d56a053a42c58d2ed48cb8
SSDEEP 24576:rI+DKrkHdCpKzgNJzXUwsuJKy0DpOQgpp7BgytdeR8mpHML9:rg7pKAJzXUMktD0pVeESML9
TLSH
T1CCA52F6F7164FAB6E204989D3D81219A4BE03DC4E95C70ABC722DBD8F6754C4D8C286F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GQUM.exe

Path C:\Windows\GQUM.exe
Size 2.0MB
SHA256 879b7e415095042d2e5b5928147759c7da7ccc0ef82c8153e01cbc757080682c
MD5 278cc4eb2bb8f8ea295b7768a77a7880
SHA1 e1d7706bcba426d372d5c7ed62dd0c2b63961dd9
SHA512 e4ae3b7e4eb8e424f412d20cf0197af8f8c52d7b0346898e2beb559f4cb705a297335326191afb763f59e3fa454e763ac25a527cf167d064503ce2b43fb87ee0
SSDEEP 49152:lq7rvbYodVSELgNsMBbk/vOgfQkmL1cRv7YQZ:UVdwELgNsMBbOj
TLSH
T123A582C7179794E3D171B6B2BF01C281E1F2AF67EB9BC8D9A879996B49C2031C94C431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GUgU.exe

Path C:\Windows\GUgU.exe
Size 2.0MB
SHA256 2242b41b2cd2bb57e67637625fddd3190b0c33aa21ef294af01f08f1e11ce541
MD5 5d7300ed7b4b6dddb5632288bb2d8651
SHA1 24b14cbcfc3a0b300f19344381e513ad0b86f688
SHA512 1868bd10c8e0db0144aa9e72d53e23fc30395c005da468aacda61d4975e61257bdaf3aad9fb5d6807270a7b3b20b5e94717fdb9a01c5217c3644013de4565af7
SSDEEP 24576:IIjijYGASjj7b/1pXJvc7ezSODtl1EEhpGmFsN1oFJpTC2whl9fuI7nsd3HHCi:Ic7ijDtntpGmFs8Ve2whlfjsVJ
TLSH
T17AA5DC04A999E469B1433FBE5806D70B9315A2DD0D19AA9DD12DE0B4FF1B8CCADC08FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GYce.exe

Path C:\Windows\GYce.exe
Size 1.8MB
SHA256 be52e7d38db03620bc373e03c9d42f9a57d0b6449d9710be6f52cb0839e6e208
MD5 8a4b385c80e413b4d341dd56ac1a7d31
SHA1 cf8596ebb23310fcbbd07e1bf6c3b5acf68082ae
SHA512 748ff375eaab0d4604e12f7521539cb610793ae48bcd1857583cefc55d1cc9b8812afa6f9b4be3cfa9d8baecaf367620045e0e9bfb0fac1fe63822eaa0030927
SSDEEP 49152:gLfsrPZWOYyJCJhb6DYGtwVWGKdUw7cRUDef:Qb6DYGtFZPD+
TLSH
T13895CCA3DE7C577B03A54D1132088B158BF29398B885F78279C380A9E5F73598536EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ggcq.exe

Path C:\Windows\Ggcq.exe
Size 2.1MB
SHA256 0249c8269c2fe9f66378ba920438cd33bdbd43b4102477fa65ba77c31c0457a8
MD5 6b72af371c2a02f7b69e40f2b414fb16
SHA1 d3a54553f33cb00669869c20649c72bf43ff634c
SHA512 69ad725f4e999cf9407105c59a206b78ad11ac8cacc5138af2f718e23497306a3370547091105164019a0803fc75170ee766c3c12a442c67b2794b7925b410f3
SSDEEP 49152:aWWZT3yvZll8RgpvzHC+Ztq6KUuWuSUr:aNZOleR6vDNtRJZnU
TLSH
T1B9A5507FC0AAF75F8DB3DDA64E31779223131A35C2C8B6C4AD4AE8345B01A93B5149D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gsoc.ico

Path C:\Windows\Gsoc.ico
Size 4KB
SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
MD5 6e9325e46193ec554308cdb9ec8a9cd5
SHA1 3e3c4a52ed1fd3a85f8ab172108c8fb61e45f70c
SHA512 071ece6913f89a4b1634daa9d650bfa8f9f406719c124a3819cbdd3cb617af419abc6010283dbb510891e9744ce03cadcceea7b137395c538f42df838b1f6322
SSDEEP 96:5wwwwww6W/rQPIEXv6KvzVqzd4sJvbZwwl/j+jNj2jly9:NQrXvfzwzRu
TLSH
T1C4911623531D1CB9FD2405F1ACF89A75A59CBA0153C63C642DEEF80F69AE8C69AF2444
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IAYK.exe

Path C:\Windows\IAYK.exe
Size 1.6MB
SHA256 fd04f2dc1f3e3ca8ebc3350e13fc1483702e80a5a30e615484331b4bb9499b81
MD5 851fea4e0d794627441b7ff0b47bd338
SHA1 c8c8da848c799f377e297a754d2f2a6af1c42d49
SHA512 905f1c8fdf742a4319f6a070681268e1f7f7a083721c8230d56a9b763d5d70db8a962726268c8b258d5ea7a75d430eaa33f6c8afc15bbaf657e1288ff9a94829
SSDEEP 24576:qDZ0bP96enryXxu0ypl8CCivLbybTyJ7tZ4twh:qt0z96tXtOCILbqTy9t+
TLSH
T1F075972E87B807F252B8C8AC3E8E233A670694761C5915AF50B17D77903F5D7A5EF802
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEEA.exe

Path C:\Windows\IEEA.exe
Size 1.6MB
SHA256 a3d60b228bdcf3755b563636d43a6e48bf1a63adaddda3133e097191e33b16e2
MD5 c3bd92dac649d3b4d558c58e1d5787fb
SHA1 a63c682de18efdd7baabd00a1ea8e7d07de0f4dd
SHA512 9d5b3a6eb05c06bd0c9517971bc4af1b690746b75aab433fc367e541356cf297b61bb821967c80d30c3bd25b82b231427dc89dd4a095a09e9e0308917a6ddb09
SSDEEP 12288:Bx0WZ/s27Cq3CwYKKg80w4k2wcGFWkk4bAw+uIxOqIs7K/T:0WZ027CqFY88/4k2wcGFWkvAww
TLSH
T15075DB859146DA52DC098BC2FA350CE10E21F17A328DEDB1E1DBB27BC09A425BE15FD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IMos.exe

Path C:\Windows\IMos.exe
Size 3.1MB
SHA256 02f984be148dc38489f82be5757e1b096834de58462f2fe7942d1e124742c0c2
MD5 d79e47b60585393b444991dcf6b10180
SHA1 484ed6bb498a15ecb862333724747e232e942c9b
SHA512 21841e286e9230335f1b32729d2cf110e22bc50bc36ba3fe15c9960a17a87195e61fa473653405763ce581247371e523e68292008b0c56c9d4eb1aaa9665b896
SSDEEP 24576:W8yMY+VBwTFt/uZJ8dDp3rPEd+hHKQR7mW518QuAoXSNegSkaYSBWF:xY+Vc2ZJ8ddjEkqQRL51KCN3EW
TLSH
T165E56050D0F15070DCDC6EA2BA2B586185E5FCCC6CE0DB5A75580A8E006F29F7A9FE78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IQkc.ico

Path C:\Windows\IQkc.ico
Size 4KB
SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
MD5 f7858e48b74b107ab160878eb400128e
SHA1 d8cdd8be514077e101a9f0a0fdbcdefaea6aa72f
SHA512 c2e950c96da0c901c550dddf953dee3eecbf9a1cb509100c93bb034351369e1547bf5b97d4aad78e2bdd516a09ea28e999e597fb0a91fb350da7b7d3ec08e9d7
SSDEEP 96:tzwwwwwATljxEbfbqacJHTTejtjmjFj+RIW:hTljxEbfbqacJHTTE
TLSH
T16E914A3723481C35FE514DF0BCAA9A9CE088BA1887C62C546BEEF59EB57E8C209F5441
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IkYI.ico

Path C:\Windows\IkYI.ico
Size 4KB
SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
MD5 2fb613374fd9eef57a03c8a2d2e52d8e
SHA1 345eae2c0189099b5367e22315b663fe6d037232
SHA512 74ed79d3db6211b1bbec4ca6003fecc866d84abb38987fe4a442558a520490797bf0b54c643b6b4bfc687b3be56d011e204d89166cad33174df82a86fb036f99
SSDEEP 96:xguRJDhHREoYxoJooz1oj8vJBI+L6Y1X4Ni:xgZb+Hz1FaI
TLSH
T14291E5E8D341C55FE0E98B77C2360C77E2ABDC6E8A79896E024C31D27E31643196690B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Isgk.exe

Path C:\Windows\Isgk.exe
Size 1.6MB
SHA256 88b3d6aaccee647dfcc0beaefb6c181a284797f59f4cd4d38ba5c30cee7bf436
MD5 2a14b703cef3838079c074ced873f72d
SHA1 71a63f268bb34bad68133853e461bb1c24e640e0
SHA512 be3eb8f385a9340afc6addea5fcd470cf28f92d5e808f3761a0d9c1ec800bbe045d3d6f4f97902ae0ba55b2c5714ba98918c77d91078ffd9a303e16cbd2f35f3
SSDEEP 24576:PzxxNhZSG7Jitfcccocre9R+JuvAYPxz9snlG73CBgD:lh4/QQ+JuvPsno7y
TLSH
T1ED75B83DB69E84732A02E2FDB5C71F89331339E64FC5415A9936F530CA228DDA664CC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iwwo.exe

Path C:\Windows\Iwwo.exe
Size 2.2MB
SHA256 c42b8a252885a51abde2939313a2e3748a2e95015ef433850ba41f3745d1022b
MD5 410366c9487003c9979d313ff9a7a017
SHA1 b67a57e2284fb3bfa4cfb679cdd6301bceb46c66
SHA512 8bb9abe0e73d9a06e882ad9a3628daa7fc4e56f39a16361c6b16ff6b6aed928788b7ff8240c213099b1e0cb30cc1d9009bec92d042ca968ac1f9e5f1aeee84f2
SSDEEP 24576:uf1ETZQpkmUKCoCqShD7qi+niqQ5wf/psD1bp3c2issKM8QcxIxt:upUKCJD7qiNhR9NctssKmcxs
TLSH
T1C0A54E100D2E30C63267BE0C02F4F5922A98A5C5BA73B5CE99855730BA7F321DB7579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IygE.ico

Path C:\Windows\IygE.ico
Size 4KB
SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
MD5 7de70c5f9fde94ce0179324aa5720a58
SHA1 b34c69a980c52938d5b4377376adf15fad17dce6
SHA512 0b5b089bb8ae1a97e4a882f7e35c7295cb81127f0915379676590a2af296012782192381e2bf3d010f0a1c693e2eaaa2f083fd8fdd7c3191a8537b4553676ef1
SSDEEP 96:dic8fY4M1c/wHtOMreoBKc/0+ktbWrrdT+AP:dilkc6OMreSdStbSCA
TLSH
T10A91842274B416E8FA7DD977E242E0AB0E723C578B41422B71D3F7A70C710D81B0692E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KAsK.exe

Path C:\Windows\KAsK.exe
Size 2.1MB
SHA256 d1ae17a26a5ae45a47707622c20532c17b8f101e22b2ea54122b59acf4407dca
MD5 2035420201cb1a45a28043d1e48a551c
SHA1 7021dabf88ab7974a31a5a409dc09e2513d94a6f
SHA512 ef9e13694f47284904e2ce687ce931708acbec69db53bf470160b40c999c85069e19dea3308177c68230bfc10d989e0b66310bd36429f8a0e24df04eabf727e7
SSDEEP 49152:4czMa8Gk/WnYt34gyHjCDM/kvOxLdlaCe:4czMa8Gk+1HPkGtvaF
TLSH
T1E2A54149A5207155948B8E00C5AAF25A332D6CDCD97C18EA0BDF713B5C936FC3F261AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KIIe.exe

Path C:\Windows\KIIe.exe
Size 1.8MB
SHA256 e455738d1d4668b4e0eaa6976b37f1ad134afe5b10eb662e29327b675315fff9
MD5 c0b7b09e0446106ad8a546785faedfaf
SHA1 e720d27748f97db22a89a57a65c6a5ed8971c29e
SHA512 86c964215df7e9d6bbc5f6b5279da741aab56e5379f94bfebb48bd7aa0ce139b2b22ca5bdce8140959c7ed6de6299ff7794e654456c404e9b8b72be59092d842
SSDEEP 24576:BgUgTq/oafmGELW44/4z5xulYZFnvM3frvBXZPmdDQ+SsvYz/BH19KdyasTcz0B:F/oYE1DnfEBCdyasTR
TLSH
T1FC952FA7877F746C2E0BA1354B5448B14C06BF486CD07CA7FC1A671F8C9976ACB52A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KQUI.exe

Path C:\Windows\KQUI.exe
Size 1.6MB
SHA256 fef985028c9f048c30451488cc6ea143cbcee81f7527c1fabd2df7a3c480aad2
MD5 a35e062870f80c33bfe04f2dbd3159cd
SHA1 5dfb26cb508caf73ef31b0ae05e4dbe7c003dad5
SHA512 cf97ecb50976b359f8553baedfa5c9935d4ba66ee17db18c4ddaf81dcbc8ffdbabd2d853fd52b0fc7aaac3bef6cc1bda5d09ec1c713231a29dc2df499a535461
SSDEEP 12288:qIv+yq7D+yxs1MnKMEF49wRycS9VGcIEvw8R+z47C0T7r7HeQ5zVVbmJEP7VvwsI:fq7D+y6U88mFKoAfMMhfZUCVIsI
TLSH
T17475B91713DFF87B8FB9198332AE2FBDCC94E615B0814403D58447A8D8ED6AB2E49395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KUsO.exe

Path C:\Windows\KUsO.exe
Size 1.6MB
SHA256 f435769ff89c25d3a7c5d6fe2c8d190166ec46a13fc94fab4c54fd3b0c04342b
MD5 f069c5f41f3caa4dda90e7bb4f735305
SHA1 7d09c82cae8b0b799080888880241b6bffa13d55
SHA512 077ef05cb8a5c1f538d138934b42e421787bb9d079b7eb05e7d8d183fb4a6524aa920ae227e75f6a3f83caf063f9601b8693a015d55a0cc54228cb953a89abbb
SSDEEP 24576:yV2g2AWfeJ8g09Vp4kc1Am+gH4BIoTUP8IL4X67S5aNB5I34B1Pe8WvozWJGJxV9:jYf+ieIoTUEILN7S5Iazh2Kew/V13
TLSH
T12F759B23D0CD011A8D48D4494938DBAFDDDE8B7E6068C6AFD1CA4EEF5FA94079A0D670
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kaks.ico

Path C:\Windows\Kaks.ico
Size 4KB
SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
MD5 ac4b56cc5c5e71c3bb226181418fd891
SHA1 e62149df7a7d31a7777cae68822e4d0eaba2199d
SHA512 a8136ef9245c8a03a155d831ed9b9d5b126f160cdf3da3214850305d726d5d511145e0c83b817ca1ac7b10abccb47729624867d48fede0c46da06f4ac50cf998
SSDEEP 24:su1Flj/XygwYAaMiM1E2/pkQ14btLH3RJigg1Kjq:vFlj/XygFA28BRkI4btLHhJigg1Kjq
TLSH
T1579127351B08C4E4EC5AA53182A706F708AD2CC3D1B4D47B52F07D7EAF33B72691166A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KosC.exe

Path C:\Windows\KosC.exe
Size 1.6MB
SHA256 f40f5c946ed8b4855b670d5cb971202617bbc4f1793705f5eaccebd7b8bcb877
MD5 603fd657012c036b7240e2d01caf182e
SHA1 36dec44c18111ec6922c98f12da474d2ac85d8af
SHA512 caf8c2e6b60408446cd8a7405e075e87021203c992fb28f9ad318d35aa17be7d715d29d40e2a76ef3145eff776314d5c4f9e01ff0ca7b87500627102cf20ffb3
SSDEEP 12288:WX4ot+UN1ARX5ii66nzMnYhbQFk+bgGFf4cvnZERzh1xix0thbBBO0ZwHDD3Et/9:hS9AHhbT+xFf4cvnZExh1tD3v
TLSH
T1B375ACA5B2DAACD11ED65CCA6F11AE72DA01B2FF953F53A033A1F0E2450D9F415128EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MIEk.exe

Path C:\Windows\MIEk.exe
Size 1.8MB
SHA256 c372a556a25acaabdf85c58ad2135f30e58c866c989309731d9d3aa954cac783
MD5 01583a78914435fae220586790c6a367
SHA1 33eaa9d7353bde57e94afa381c566d61209942a3
SHA512 4faed1ec94eae0c211badc5855d5e0b2308b69a35e4c4f50dd49f5b149f9bbaec2c6fed84e2569f781b4fe2416baf492f6e9ef389b9d9985379b4025eea1dcf0
SSDEEP 24576:Uut6A9fULQN7cC+Z7+YNW8hAyetQjZtY:bUvZ+YNWEsgr
TLSH
T15195E95ED036B3F16A5092A10EE0AD7020E72F9372DB17AEA643D5F1143DF081D967BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MIgQ.exe

Path C:\Windows\MIgQ.exe
Size 1.6MB
SHA256 bbd6557fc8c81ae57d403673527c348e28268b98106a5d0cb2a31927490dc857
MD5 8ee0cf41bbae7420b8afb9c9f7e5f97a
SHA1 8f25036c4c807f3b49f34d3b54ed593fe65e1bea
SHA512 e4ee44861e066304c63e45a67772838ed718d68e23cae890290fcebd3dce94da3ae6d9448d4d745d683bd30949b2a24a1db052069ed443dc2b8dcf18fb8c2201
SSDEEP 12288:ac8L50L04vZ0Bw8riWO9+UHg0w5bk7IPZgCovH5VV1tL34x4X9AHZ:Y80mZ8riWOmksPZgCovLV1tL34+NAHZ
TLSH
T124750F648D4987610150A4BB947C07168AFC7FF9C2CBDD1751AE72A328AEDE7C22BC5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mcge.exe

Path C:\Windows\Mcge.exe
Size 2.0MB
SHA256 52d7a3e6157af7b9b220d78ea09ed381bf159d4009c851c630cf2bd7efb8def5
MD5 451121cea364cdddd8aa788ee59e5ef5
SHA1 f35b74dd8d3eb5765474a5fad13793c3e5bd1533
SHA512 dba4a9cae7775b9b00c257f7ebd5996022deb4e8349ff21f0860debe1692eb444503a6e94345e08cd636d7f3e30100445c3c7e591f4a032cc74af4cb8ccfb2db
SSDEEP 24576:aw+3r2op9Of266aOCqEPh6L5YkZspcKpRC4X4Wt4NL+5b+SR+L:D4Dps2GOplBZWcKpZ6NSbRQ
TLSH
T153A5EBD2FFB9E6DD9F098BE8305EFCA1802DD9236B07462E017B375A5B04DA4075D2A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoYK.exe

Path C:\Windows\MoYK.exe
Size 1.6MB
SHA256 989e32cd59be42889b943c66a74f80801133c57e1edb2ab9c0cbc913b9e367d7
MD5 00aa4572f8e8dc25000db26f96cc1173
SHA1 a9cbba6c0960f16bbc2cf4d0ac64e1634b011e25
SHA512 4360edd92666d3ccb8656ed15aa51c08de04e3ea4e715d05a73972f7b9c6b49daf3a94b5c73318c29a3d073fb2bd7fb3c2aedb1fe0d847374b0d38a757eb4892
SSDEEP 12288:jbsKdllDZv7YH/Iwj4U8ZNAm1dBXwyRXfA54uoF3Tthe93S9yAwuz+afBH9Ai1/m:j1NDp7LUKiyRXDuoDaahvNka
TLSH
T1C1759BB4D003C88EB87A7847BCEDBFDD487576E074D0DA2762A493DC36B0A1762C52A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Msgs.exe

Path C:\Windows\Msgs.exe
Size 1.6MB
SHA256 3254db44a40f64372e409a369f462b6aae342ad8bb0f428bc0ef5829b3fa9cc6
MD5 581f91c4d6bf5e057d15a054f4085f94
SHA1 a4b6359e557f18e5578979503d419ffe3bf8b36b
SHA512 87aefed0c8ab54010c12eaf8803318c999ac818434cbd71dd3476df7e715f013261c4b31a35a54e5cdc9aa4afb49f4e0446add9159cf7ef2253338cef17f5701
SSDEEP 12288:oHS/j5l64DKYlzxQCgqDLFF/+YyuanymwVNT6RhkK0TdF6n80pRGyFtAKiuKkKi:bbVAufmwWM6n9RGyFtAKi9h
TLSH
T1F675B9519E2380BC711D3CE8F3E82319DBA82C2573D247788E64AD655B47A1E2E119FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MwEg.exe

Path C:\Windows\MwEg.exe
Size 1.6MB
SHA256 8792262c2eabefabea330f3c934f7a3864c1124ff7eb7239daf6593b0290daf7
MD5 2cda40bc978f4fa0bea10e998a10b510
SHA1 f7eb8fc67ae1469e458bd28112fefd8285463e58
SHA512 eb1eb8cfacf1c469150e85df569a8a40d9eabfa8cb150e2d5dda8ce4c7c914ce924ce9b5b99b8c093abf00a2d00dfde592b110434c740d4b0e2d3bc4a1265420
SSDEEP 24576:uqc3ICISAOEkAf/CpXlGq2jSWaVSNfrzNwZTxq29O0LZT:XcYCZAOEdqoFSWaVSZzNwZTxq29O0Lx
TLSH
T105755E2CC8DF47365ED44A8C6F0166823FA70886A73E9DC8DDD763E451C26EA2D606F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OAcQ.exe

Path C:\Windows\OAcQ.exe
Size 1.6MB
SHA256 5968e8287d2fb5f12bd2aafd28025d383ca42c7d64feaa26ac0698d55432d0af
MD5 f17018c81359c4d1bae2fcd810c848e1
SHA1 4389ab4bd9a521a7fe2d326b308cb87e14c2c501
SHA512 2b3d78e4871e56183d14eee8d8fcb696f7944d9e9bec6467fb58172d8bfde829c7ddd2e420ab53992a8d7bcda14bd2fddda3d712202095ed08f576b7e8c8c1c3
SSDEEP 12288:i5/4eP7yvb5pWmJFjguWCceTbmxO2qNAL13UClID5E24RkMSYb1T+wcBN:i5bP7Ix6eTMqiLZm5z4RF1Tlc
TLSH
T1E775960988BCEE07B5ACECA97AB0DA9FD345F88D6F156F297CA9B30D1645CF0904106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OYkm.exe

Path C:\Windows\OYkm.exe
Size 1.7MB
SHA256 f1a3c31d0298c549c9703b17b08e47b7c3c4b669c3dd43362bcb83dbbfb089d5
MD5 9c525017a94b88b2d39872435696bfdb
SHA1 9cead93f23ad4e818cc56ac206d9619521533f00
SHA512 ff264b4b9449625a1d354eae6ea7dc979f24463fa60fc3ac0b50f231e675b692c2daa6ab6ad9ea46d7129e2fb4b27919b0d8fa1adca61016571678b2b4ac877b
SSDEEP 49152:XKQsz1/BAS1dNspTRAw8RXfiDplHBJVfHAVOHfUTI7qEoT:XKQsz1/BAS1dNspTRAw8RXfiDplHBJVC
TLSH
T1D185CB4278F02BE265AA0FCC14C72039FB33F529AEB6DCAA1A198E3567375444DE5C5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OgEi.exe

Path C:\Windows\OgEi.exe
Size 2.2MB
SHA256 72f9d80af6aa0707dcf5803ad21c0be87dacf7f12c32ff514526890bc85b2698
MD5 b408e06d2085ef58751735150f55743c
SHA1 4e71d9a0858fd8848ea4e7fbb41ac59c3f500b8a
SHA512 f17ccc233c09d4de689fca82ff4f6891a96ab611010fa9915efa8396e2057bb4b242d7b98cf089ca6943a1200221c07162556b8dd7d1c504c5d25b7f7ea2f7c2
SSDEEP 49152:bX0mEKCQHek+NulnOJf1B2RF0rnpKX1jflVLClnccsd:bX0+HekcuJOJf1Bo0FKX1jf+lKd
TLSH
T128B53FF166741176224790242E920F00B746CD685B6E0933D3CFBE55DEA7AAB1339BCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OkEo.exe

Path C:\Windows\OkEo.exe
Size 2.0MB
SHA256 62449bcf338cbbe0f69098161ea24f95c972409268cab6ecf367e5088fb5cba5
MD5 591b120951ea1dbf9ea6778edf80b47a
SHA1 7026c8bac562c890a03600087cf8e4691716b69b
SHA512 ad5cc8eb86ec6b6a899454ecf803997cec50aeadbb994bf17133e43ca9b149992076d1a6713036d46f9043e3232e8550587ddde1650644051ffa177507947a82
SSDEEP 24576:td8QcHbYyDiQizIXfPf+jxligdnyHa1AFirsU82E+dVol8:bq76tzIXeKgNn1AFirX82K8
TLSH
T1FDA55E8CE978187414CE4694FE480D09DE1195D32E0B6F38A798F67F0EB8AF9D7E8164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QIMa.exe

Path C:\Windows\QIMa.exe
Size 1.6MB
SHA256 7f05e51998cdadd7df0540c799575ab34d547eb8411aa9fcd080e8d0e321f0ec
MD5 150d70cc3a935cefb2c3451f3aa978ed
SHA1 a476e8fff515bf93a42672dfd510a484495aa62e
SHA512 2553f06b2d6615841f1e2193eeff5c88a2360af114721bd0a75daa3b24a7b2ed51977e10151721640d17894ab7a5dab64b44e1a8cccb4358762133ec2bc63418
SSDEEP 24576:Hd2X9zMGXuzEsQeW/fZSFVFTrn9niiDh00lre:49o4uvycnp
TLSH
T10575AA799AB8534106D08AEC14AF40D1A1B0E4496ED8EE5971F797CF3AE3880D1F25EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QQIq.exe

Path C:\Windows\QQIq.exe
Size 1.9MB
SHA256 0f77880586801bf21ef02825c292874dac5c360325df4dc7eedf11e21ed18597
MD5 993cb683f166a4751d62505cb653e8a1
SHA1 0482d7d10cb6ff0671ad0d5becaaa1401b6ab585
SHA512 3dbef0cac349af75b74595f17d215c35f73e72c6c4869eaffa16838eea2018a20227b0974eebfecb80bb9fcbaccd2abd3bc285ca8ba535ce269039fb5e0b5fa9
SSDEEP 24576:HvO8/+SPjdN8k2nt+uIoTlutDuJMBJSO4XlZ19Pzl6y1bm:HN/xst1OJR4X1Jz
TLSH
T19C9540AD4FD356FB1D45BB8A92219DAAB13F41C19AC1F13C63213B7922F191E6018F87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QQMS.exe

Path C:\Windows\QQMS.exe
Size 2.4MB
SHA256 952978c7161c61d5dbd51ee01fa7ca71ff919a5a3d305e75a8add1d0413db072
MD5 318df6eaf9df4db48681cffa88b7dc63
SHA1 8fd48d289106d1a25cf003809964c3cf64d59231
SHA512 b0d0c67082c7b7f27a9b73553af0a736d532ae43a92d7ea941dec39d8129f2a12b579aa7bd34ada0a33c36a485ef1770928dbb42b126ad393b9a0750ef04adaa
SSDEEP 24576:lQW11XmJSoEdelp7pC5HpwFSp+3Y9DQcI/mDsKcX8n3LVTLWhwEdLpT8WRh1fneF:lQs1WRKJwzYHsKcX8n3L1ihLdLZbf/J
TLSH
T123C56411BB75068DF511BD2D62F770BC91261FB6C110FBBA2398ADBCEE65AB1AC00057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QQoe.exe

Path C:\Windows\QQoe.exe
Size 1.6MB
SHA256 0a0e5bf21cdf021556134c83160551edac09f95763e644fd8db11f5a91245ef9
MD5 75440200878e5ff344b637b4f241f853
SHA1 374c449e43c0d2cb33cd97e994fbbb9ad5ea25aa
SHA512 b30cf59c5b0ffe63482e69b600257732d2c385fcb8e826f1ed780a979b4a21f951cf34664a70edd6f887269aab3ff2fd10a6351f3d2df7e536e6dd0e6f52e9c9
SSDEEP 12288:PW3SyLUrzel7TDOhCtQW0alh+l7Y46IWc9fWX1ZCZPPfrUpfrjn3Q7PXv9zImIog:PkRQ2hahCwaPTzX1eUV3n3QzflHI
TLSH
T18875FD6AB613F0A2962D2EF02E7850A294F1673C57FF17BA54A31F329B63D911F93500
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QgwI.exe

Path C:\Windows\QgwI.exe
Size 2.0MB
SHA256 bb5fd5275d9ec1660e8a970b598b9f6e54cee31037670c0e226485e48bb720f8
MD5 dedaf414df17f913f056726037ac90e6
SHA1 41ea8d8cbc7734d8e14934cb033a2b56a48e943a
SHA512 f59af001a287795b55c564cab4bda703ecc0a61d06bb735b5da88c61db895c4c8ad6ecf2a72b8c70e00e7c38f7e5ce810132d443900c4c2578c279a0eaf5c5bb
SSDEEP 49152:RmRnEaHWGF/XlqOp2AET5eVdgV5jjggtjD:YhHWG51qO8T5e8
TLSH
T1E2A5B690512F77C5AC6060B7918067534E386F88871B2CA45DC7726ADD0A7FA2BF8E37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QwYE.exe

Path C:\Windows\QwYE.exe
Size 2.1MB
SHA256 cf703873253f986b00bc4cbabd7f31947c20f4171fde41a9695c782943a1d1a9
MD5 59555ad1d3aca0f809fa89d25ba72e01
SHA1 928a42753fde2492867ae942e4dcb9bb2659454e
SHA512 842a3ecc64b6926659b7f08c606fc1f8a62aa84e06fc66a3efbdf2ee3fb87e2072e739d9a21446f52541c1814110d05004c7f804284bf654d1037d61b2e56b8e
SSDEEP 24576:KL0Ht/d2IqX6x8X99tquVyMNj4Gzn8cG5a8j/UyqGxSMmE3CM2FdN:VgX59VD9D8cGo8TUyqGxSBTf
TLSH
T12BA51BBAA33449546D2ECC80E51110C387D8EE9D199F24FAA194EB7E7F578A093D3E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SEsk.exe

Path C:\Windows\SEsk.exe
Size 2.3MB
SHA256 e07692965af632a2cb7614fb44dbb54297db25cca7a9e3d568cd07a5fd049729
MD5 26bab8ab32ff556254768b4409fbb199
SHA1 a9299c9ce92a0e9f8abfae6df32949d7b21d1ee3
SHA512 82dcd0de4e4f6988fa946d2ff2b251db632aaf2df618f5de836cb5de91db2dc96ea8de6113eecae147f7eb0d89545e0c069eec2755cfaac5a284695ff67fa244
SSDEEP 24576:twUCBgnGao26WcFWAVJ/XuGOZymOJchaeLnoASWFGmPa9n2d+Chl91WSD:SUuLa9kFW4JNmdaUnoDQPa9Mhl91Wg
TLSH
T1F5B540F962C9B0F833D48635EE200472CADD886178899DF447FDB914F4E66D5A28ADC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgIa.exe

Path C:\Windows\SgIa.exe
Size 1.6MB
SHA256 66186db20277074ec449e1f8ed4795c18cd1ad196c0ab5ee2967dbc19b922e3e
MD5 8dd9807c5800b7fd4e8de7e6698639a6
SHA1 fd5f977aa66c0d16517c66c44bfc0a42805adb7e
SHA512 ecae6d367c6beacdc9d2c2fc1a7072b6915b5c862effe2605daa2869e1abba6c18ceb8f8ef89aca7f6215c99ef61abe4796154f15597d4d25d872dfffe7980a1
SSDEEP 12288:vrvqjDVDHsigwoQM+/kayKmG5wyRA8vkgxCijmy9N6F8IrlARlgKzjp:vrv4lspwoXMwLGmB8MjijmQ6aglE2I
TLSH
T11D7572A0D21DE2A65FEB42147874C97134FBCE9EDDCBB3E76B9BA504C6F9240D11006A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sggu.exe

Path C:\Windows\Sggu.exe
Size 2.4MB
SHA256 4dd18c4a18da7544d707b707a1e6b0f1a1d4d85cacb63de4173144a0a5a5cae6
MD5 ea68bee47c308c5a9bf4f26004959a31
SHA1 f8450f77b2199b2effbb6c82296aa727d6537423
SHA512 511e10d7b2b276bca127a0c4dc01ff94ade8b4b7d8202926591827110c5e699221810d6182efb9d2511017c482d2a732d571ace2a372d3a349e716865d076c15
SSDEEP 49152:ocGUHJbFLh2Y/aHcXgUDwpPiwJ9eae7Kid:ocGSFLh5/ocXgUDwpa69en7Kc
TLSH
T1ABC59360886FF8D2B460B9F564601D1B5AAA3B891A71E661CF03D44DDE9DC01F8FEC1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sscc.exe

Path C:\Windows\Sscc.exe
Size 1.6MB
SHA256 deeaa694c7794e12bb8030a4dba32438bc2dcc0265501333b3b69487cc17a78d
MD5 f9355d55e9d456886b97b2539513b228
SHA1 c6fd1e82778e4b44b07ff00b730f40b420526139
SHA512 c93757508b2f82c3d6032183cd749c295c32cd4ad3a773dad4eaba71e3b0b30c8b4bc8443610732deb0e62cff6008963ef85ac2675a5d5b5073f217a4888c203
SSDEEP 24576:06nJFSjVkxQkzfp5VRMej88xbRQgPO5b9J:06nJFpLN3RMeTFRHO5b9J
TLSH
T12375BB181190F732B631B31E3AC07B4A697E0900DBB67350E8A77FD950BF3296E57689
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwwS.exe

Path C:\Windows\SwwS.exe
Size 2.2MB
SHA256 a6518ac0334c1b99f7a15f17b534e55a96e4fbef2d1b3579d50acc4a567490c1
MD5 7e8dc93e7d272b3db2131d1970cdddc5
SHA1 c97484dae7eb454c668f07a4b314eb690aa92a05
SHA512 1429f7fa07c52803346137601ce6c41a49af86131ccf4b0cd34b2feb191cb5efcabc65eb11a79d5b5754a9e64280461cc5692d0d8a03e7ce5fed65536d97fceb
SSDEEP 24576:4FbHRpYjXkX6NcHFR1u0NqhwTKSSiZ3BuRFbN7Di53+2JgYKoBs5jASZ8LVE4ztr:45H3lR1uy5SPPM8wK0YZ6LV7tvns
TLSH
T1A4B5823BC93515C39F79948FF27231B528CB8F4E340611A50F419AAE4E3A1A636D773A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UEgm.exe

Path C:\Windows\UEgm.exe
Size 1.6MB
SHA256 8e498ccbd97d53298813494956fdb686d0f167ce6d3f79e2ea143f513dc4970d
MD5 a5aa0a9bf240b72ad05a9cd0046eb0e2
SHA1 3df4c4c59e5dc25f3f2841a60cd4cd7634121b87
SHA512 314983c87675618c12b4507b52dad1f3c9b9335b5bb9473dc1358723f81808dd9150c9691ab3c2f04ff7f79a410f5a99e1f0835707c2e188234dfb060c8e12e2
SSDEEP 12288:fFiXgVu/GrZySrgCTLuTEfw9Wjqpg/DjSvGLuC7S+PqbVFGX8+3:fFiQu0ZySrgmdf+NKbjSvGWYqbVF
TLSH
T1C075784A71A6C163B06B60338624CEB0367ADEAFE159F85E3E66B853D330C243DD1576
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UMgC.exe

Path C:\Windows\UMgC.exe
Size 2.0MB
SHA256 699b40cd8e4b3c7e21fbc22e82e58650a3f16737427effcca45e382ac92b8a45
MD5 d8a9ef5df596ebcfededbd214f6fb5b9
SHA1 861c897696ac91184e8c492cb18191539f1174df
SHA512 1a769daca350f33ee437e68ed9d2cc14da0c81ffa9e3f40a974df3739067607223060a3d7f048a053cea62bd8947de96caec7ef8fb535308747e7e05e71f8ce4
SSDEEP 49152:rb12AqzNXAuEoSH6btsOYQ52cjPcCZNYlZZ0tfHxFa:U0H6t55oCO0tfa
TLSH
T116A573D4AC95405F9C3AEF712AC8FE528DE0A427C54618B6CE5DAB3CD8E00DAC1BB157
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uwci.exe

Path C:\Windows\Uwci.exe
Size 1.9MB
SHA256 5f6d59d79227fc3e7beb1206379e5bfecc5b9508df406bcfa11762cd5cb23681
MD5 dfb27d4f4f65d18796c561a0e04b32f3
SHA1 35e0f06997c5d2e0e911fc37d975fed49e3e9f53
SHA512 e29b14905c51331273bf9850af081ad9169b12128ed030db7805b5087f662d370fa98cb768e360e6ade6929fe96a10f13229ddf344b797e611cf4588903e7dea
SSDEEP 24576:ovKgJ24DA3011j/zxtEIHBD3KlDvd77HuLwS1IM7HSVsDK1:mJ24DA3011TzxtE0BD+PuL7lR
TLSH
T14595E9710EE4CC35C261F999B18B6B292057A4F4DABECD1844E336A92B7F4EC85F9C14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WAYw.exe

Path C:\Windows\WAYw.exe
Size 2.0MB
SHA256 c86644d9a48b634b9994995b3dcc5b33b9bdc871b338ccc6425073d5e2178626
MD5 980182efbcf796e0cc96b879a7d736fb
SHA1 18f6674cbdaebccfa215fd270e4de0548e2ab9f1
SHA512 b2451d831b4d25bf7f4146f7dbb5e9d67da46a55fab765598060ad6fb869102f931d970232afb39ce008f70f351f1a547db62248acf917aec0c738e15bf3fa65
SSDEEP 49152:qtdetG3YD48KQEL9KCncOXMULO1T4/Hz7:q6tG3YD4jnjoT4/
TLSH
T16AA54E63B7F3F2159DF59F05E78C234CFBC9228DB8398519098021559002FAA76BDE7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WEQa.exe

Path C:\Windows\WEQa.exe
Size 2.1MB
SHA256 f46afd406cfbc97d476a8f568509befbac2e79c9e626150ad060ec471c107202
MD5 7fd5950891c47b6510de72540d8c732d
SHA1 543cc1fa912b170cfc3cfd1dc41a3b8c4bdc1777
SHA512 9695181ab188e149cf48dd4bb9a1b57d2c8f1497ac03ff8fa8de03062d41af18883ea186af30f86e2d6835baafbbe0ab461ae230b0f8899f99b8d75311297381
SSDEEP 24576:uplvXu+crrXfngkI7mcUZpcVdjfpxGDfnSG8M/CC6WM:gBbuPnQ79UZpsKbl/CAM
TLSH
T138A5203A15384B9B73F3EF9D2E892FAD488F59E724739921CD710332153A965A743382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WkUO.exe

Path C:\Windows\WkUO.exe
Size 1.6MB
SHA256 bbd6fcfb2ae04d158a5a48ee895a3357405ab2d87087c279d785eb39acc88f95
MD5 884e9ba0d7f98839a5b4b34bba02f5fe
SHA1 5c8167609ffed63d59fce37c8dd0d1e61690d39a
SHA512 259fff4b967d6b31a5dc4970d3ee1ff23ad7999302eaacbc60e58f8d1f87337a9c75b130f47bdab8473457aab45853a56a937064b05591384e823d0c67d05e37
SSDEEP 24576:7RgIN/Z07w8ulzLkltJirpdgvsdTTETV5WFxMt:LT0Num01dfdOVH
TLSH
T18C75689EE10D097602F171DEBCB12BB9EA8D8D7A1A97651AF9E3555203039CB34BD03C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YEcO.exe

Path C:\Windows\YEcO.exe
Size 1.6MB
SHA256 522b22b5d7dd3dc3ad9e31067f9eea98b41305f7891786277b746ea6658cb80b
MD5 73e6fd0c45399a81f6c485f7032f688d
SHA1 fbc8f934640bb66d139070f5e465037bb508b906
SHA512 9950b56919519379d10f1b4ceaac8abd53f77ae5e478b245550af7acbd5c76798c47d759708f8995487d9d762cd8512af8adde765fa4a67aab3786a48b79a4c0
SSDEEP 12288:u53JItR5TpoBrbCMqCdm3HIAZYXsOyoWL71vDfdAVeNpPS9eTLIyDrj+YN7UFAEt:uJKtR5VueF3hkj1W5BSej+YN7UVt
TLSH
T1FF75DF8F4A0F9CE368D10352468F39C4696CB1A9BBE92F0908A76D14BFDC5A53DD742C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YIMS.exe

Path C:\Windows\YIMS.exe
Size 1.8MB
SHA256 598ab3cb483d7573c6a5079e0b40778524036c883ab7e701b476f3c5d025a248
MD5 f5901d1bb6fba0c00291494633a1950d
SHA1 71554dd764735d97f17251e09fd6b5099f8765e6
SHA512 636aab05501e181d6237b97f734b6bb549c85836c6dbc63ecd8f7746922d7ef16a809c5b54ae72a1ef33b05f9f5d2b21174f345e01ed61229d828b2912a0f101
SSDEEP 49152:HHdzckhKPHqUUZNHMyTBxHZ4romcYUOmPXrkij9JY5TpAD0P3xjvY0RsB3sHIRhJ:HP0/cvbDJZF
TLSH
T191959443E7C6476052329049442E5E27B1ABB6EC0B773CC9194B6D18AA8CA84DF7FF71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YUoQ.exe

Path C:\Windows\YUoQ.exe
Size 1.6MB
SHA256 31ee5d32e73a30766d201d5f197aa4fa13e5bb472d230072ca966c7090b7e030
MD5 72b3ef4f1dfb58e041ea577e9fe0f070
SHA1 9cbc60611a1a282db011c73ecef77919ee07ae71
SHA512 fc35c6867da28759db9f61e15b47655a5a2475f178e47efbd090b0e14dc1c88f169d80a57b95ed0f8901db8ead9f5626963ce6af8c47fe53525a0b569d56e15f
SSDEEP 24576:i3RHjh8vtcT2S/ojvYmKokvzvXnbnmyRXEN6X:i3RH9ytcT2SyvYmLkvzvXbmqUN6X
TLSH
T14475FDB9F0060BF8E42774B33A4ACB914D3D54F386D6578BCEDA65E8B2161F8884D21D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YkAa.exe

Path C:\Windows\YkAa.exe
Size 1.7MB
SHA256 60cebc639333ba63badf9d3d85693458940689a8fea70749d104bf9801119fcd
MD5 2d180ad62e929e9c25aa84a0c8494ec6
SHA1 40246bc605bdf7687a6a805b8eeb64f722a06af4
SHA512 3b9315c89592df70ea9634d2fd1a3dd711d0a468e80aed036d2700a1eeb46148ab780c26fcff4f16744c16ee37da00900ecc14313466ff078eee030829df58c9
SSDEEP 24576:jueTXRdiOnZ0hap5yK41fy2yjxSTIAVSQW71kDdSedr/7Tu5:eOnqgpUrDyjYTIA67yIeJ/7T
TLSH
T1DC850BC5E767464BAB81B03EDD73276DC5C203366FB28D3999AF3C6D8B1620257814E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YoMw.exe

Path C:\Windows\YoMw.exe
Size 1.9MB
SHA256 8dca86862c258c2a542ec9e029446cfe2d81281ef243c3ee4fe365a856b2760d
MD5 d7f65f34977207ea601f64d2241ab37d
SHA1 051c1fdae8eb627e256e24d9bda4677086ba6b6f
SHA512 8f9ef50f8cf480185fe098cf6331f704d39e3a6c0f1597cd1c185fdbb6ea69c05d9fd88315ed66499084655a3c849c29e62a0a2e155192ee15f2f5acaf2f159c
SSDEEP 12288:JgcZJBdqiKkINLB3zku544GbxERiU0q3QN6cUGaoxKT9wFxXlswJnG:JNZBYhOTbxEd3EHUGaUiQtG
TLSH
T1979511065D6E017BC724C4543606DF29EACC8F2B7E327D47A0A5B83D57E9D28287A0ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Yogm.exe

Path C:\Windows\Yogm.exe
Size 1.9MB
SHA256 7bb0dcc15813207000ade24c7337ec553f326e7322100b9213da533493c36c10
MD5 86d1606288f807c290d03025dc720308
SHA1 3ce5f13c2c433bbb59a2297dde77539419b5c22f
SHA512 fdbc9d1a85c21cebe10a53127730b31867d2def60d36f48a6dbcbfc1216c3ecece1088476452397de9a3d9068fac3f33988aa5db4d8b586c1983409ed199a7c2
SSDEEP 24576:HbsXyfk/VljQBgo6j8nVJefhtoU7py+esyAqj:HbYygjwgos8LeXhpDCAq
TLSH
T193950B6711A6F880E7226351D44FA869D468221E35ACBB300EDC8FDC1B6C795F3F9927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YowE.exe

Path C:\Windows\YowE.exe
Size 2.2MB
SHA256 35b480d3c1746406bd8bdd2f559088beda6c9485bcc9fbb79a498e79755d9437
MD5 e13733e333201df87389783b785b9736
SHA1 5d4ba5fb3f5ca8722197c11b624facfb1d7a17c8
SHA512 e2af688b2cf290957a669047a9f5f8d45f50efe0e8a4ef623d19b3f65c29efc4f090aaedf13ab6a03ed7fa8b4859422afa3f96972f8948493a3ca243014ff64e
SSDEEP 24576:35f3YvPtOnPitGgTb2MMGx/uokesJB8tVgGxq:xElEi5Tvx2xesJBYgG
TLSH
T1FAA530AE7AB592507BE721E531E2707FEA1048442537A5E7EA1FD052F82F89E3500FE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YsEs.exe

Path C:\Windows\YsEs.exe
Size 1.7MB
SHA256 d4df0fb72f401a4c31823f68ae4c82c5a096c7b0e3fb2339c0bd032eaa28e492
MD5 64b1d5b58f51c2895365fab301adb61d
SHA1 918c34f649d3c10545da73c6db47b8245fb3f24c
SHA512 bae226b1dc3bd1c44eaf7ab94cc60f2dd7cd0019c96090be1d3f934e62a3121c0c12bb039305d95d09f6871d38ebb82074d7b62257f9ca80e265b6f9ee92cb41
SSDEEP 24576:moi5nLCTL1sXyCI5nWKzN1WCJ0R2Afd4:ELCTSXyCIUB
TLSH
T1B68566C4A7303415A296078E67B05DBFE242AECB630ACA9AD54C86CD45CD4EFD10ED7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aAIE.exe

Path C:\Windows\aAIE.exe
Size 1.6MB
SHA256 94a86924cc3c2a2a1f74e1c308b383c6e900eea612639614a3b5bdf6226d9d86
MD5 150ca65a71ce8a2a5cd52132ded0a60b
SHA1 f34d82090f571bd9519054ec6b322732e323cd39
SHA512 bb56053bf6c8d5634ead258d943e150f5b4466c9584a9a6c015f30409299b83b5ca837da2b693cdb614b65862beff7fee6b8210d992fba4465c536488ea99196
SSDEEP 12288:NmvFRnnnnnk9Km+ID9DDM66i0dhLkWoGjQIS9ArIUXvfqp+xqrvzyGpw3wNLD63R:NQST0deqQIESr/SgevzyGa3TjLvPh
TLSH
T1E975D9B50B0DA6EB8C398B42643509C82315A477B5E15C3C7B40AB0B5BF59DE3A07B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aEoO.exe

Path C:\Windows\aEoO.exe
Size 1.8MB
SHA256 7b56d016f2a6dcf39be50a55f582ee208a18c3b5141c04daa6e14b38d66b6dbe
MD5 5490beba77b54f5ba67de13b56cbb5d0
SHA1 f6cfbd5033fe11e99bb3d61999f047adf9fedb70
SHA512 8cd20c1e1547a737653385d6bdd774a6bd3935c3e10528cf7b06e5a3ba341b5971c7bf8cad98d65df5cc9c48abcc3129ee9f6061a56e9527085f4d1ff6c7dfd5
SSDEEP 24576:hALiDsDk18HsDZPiXsZRab0XJtCJr1NQ6w:iLiDsw1Ss1Js0XLCJr1NY
TLSH
T175951DA61A4A1ED77367BC06221F7DD147CA2B469E963B936200441CF6242E2DE5FCFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aIQM.exe

Path C:\Windows\aIQM.exe
Size 2.6MB
SHA256 7c713a0559dbcc0ea239556e899a10069eb42b2db8e0b93ad9e9cbb31e8b3749
MD5 13563015eea3e2bfcb5bfdb08a18bc12
SHA1 16a4773fa6e67b067f8d863899815612002290db
SHA512 4ffee780d914bde38e20389ccb5ea378c629b1716b144a74c7fce8aaf40df65f370cc6036c3faffad1c7f2dc0279cada71a6a6100305d79028048370c6a1fea1
SSDEEP 49152:F7ijaNCwCZY51qvQZ4sriBfTj2KVrRiKGlZfI:FejCCvZYaQZ4hffRidZfI
TLSH
T190C52D54DC644E8F59F6368C055EEDFA74BA38FB5C11369C28909830C3A8D5EB62FD82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aMIk.exe

Path C:\Windows\aMIk.exe
Size 2.2MB
SHA256 226deebbc5878d203502e7f56d157deb36bdc8698f9de373f48d20453a6840a6
MD5 9888b8bb0632f79dd9608a2b0d105509
SHA1 60dfaef8704be01e60f71af29b7f7b6d9f268edd
SHA512 b366ffcf7d7eadb0fc671e2193a4e098ed99fca42248b3805c85a4fc96c10da6e4a0b67efdc63f7d547a18d082643277fbcc1328e154bec75903f822695963cb
SSDEEP 24576:4BI+Der40NzbmBrDxS5F2wZN1jk0B0ETmA+poaBvR5vs0z3f3/0BDAQ/5:4BIqer4czbmfSXRa0d+pteyv/Q
TLSH
T14CB52D0B6D84AF3B0DA2A43EAE726D413DCF84F4B86C45E345C7B0C98995715CCDD8AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

askW.exe

Path C:\Windows\askW.exe
Size 2.2MB
SHA256 bc6e4631ccd6058b3f6aa05c1786bff34a05e9ff732bf0d9074c53eafb121739
MD5 7308999de1515420ec0a3fb22c899ad0
SHA1 81f42eb4e90e7b8f4839696100910eef9ed8e6b6
SHA512 2ac3449917f0f39a423f67e0cbb83eedca6ad4ba8803fe155fa0798f4f87b6c0e86810c829449b78a61a37c264cb233e7d7498a5dddf35c10bb464abcfc1c0d9
SSDEEP 24576:hPl4gIrSEqknPB4fcgS7PtvwWOOiXxvYAtUxPzqKEWx9NQ5w8I7TT7U0:v4HGEqkPB4fcHOOiLWJzqKEoy5wdvx
TLSH
T198B51FCCE36CAE16504A7AD2BA987D75C6D4CFEC4633554498C2602687FF8E607E01EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aswe.exe

Path C:\Windows\aswe.exe
Size 2.0MB
SHA256 eb943b41b471b3464c6b2495d92966d30a287a5754430b978df744888b7d54b3
MD5 8b9d1048e8abdbb7fbd3e7b3e0436a82
SHA1 81ce9190c7103a43d6950e6495635fd0564724ec
SHA512 5b44a0221bae46fa6959ec38b47dc78a1e5c75a50b54c9523cd97ce8818d371255af9a4b3f775304af71a150655be4f380b3b417dac98c0489f8eb5caa54122e
SSDEEP 24576:7t1u3s783vHqdMtqslqK/Fmcq7ua05SRxsZX1I:7t57CHQMtqslqK/kcq7uUxsZm
TLSH
T170A5C6F0012CB1DECEB97071D4511532F8C6C69BA90612F554EE2EBE9EFF0A42176B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

awUY.exe

Path C:\Windows\awUY.exe
Size 1.7MB
SHA256 c8c170ef5449c7e9d9e3d1ccf0d82ed41c6aaaee602bda6fecd48fc0c4f1e016
MD5 77acd1cd2d553c5fc971771e633d07ef
SHA1 df8cad8e228188efa0a9dcfad67e02ca554679b9
SHA512 ec07159bb4b1dfd4d47ec1e58b5cd8647a3d4da51749fa7641481689d038505749152f92b295b760fc638bcdb41b1b3fb6081954f94bc92e7211e2805a4bdde4
SSDEEP 24576:zJOlxQ9AQ4NhxHfiUzaPwMtEtqs5yvx6O8BkYLe6VObtJ8+HWOD20ecMlPXXwOii:zJOPSAz2w6C2mZCdw1XG
TLSH
T17385880F46FC34AE1D4CA870154AF51D6728D38AB86B424F517A8D2B4BED3D22A71FB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cEwU.exe

Path C:\Windows\cEwU.exe
Size 2.1MB
SHA256 2be78bf3916e91a3d118e2dd949a633a5d362ecfb4d81efb0fb52ca060634714
MD5 8a0502a9c1c643fd8f2ad0b052b1ccc2
SHA1 acdd29d9f2dd6f88b9ed8eb0afd41e6ce632aef5
SHA512 6a2f464bd0bed0942a913a3993805dac7231625d2f95682b19315e853bdc2d224912a65c7478b235e00633f2428d308daf6e71ce3108a7ecf4de197f80d0a0e6
SSDEEP 24576:P/9h7WM8slNi4DAX9k+SQFWbuKEO4dA5imJerWEG14ATWZFsk:nJFvAX9k+SQFWbuKJ/8re1BTWx
TLSH
T1FDA542E35AD9893C36B8D50429439FFD5BAB2BD0F8C91FEE07936A273619C729310491
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cIIw.exe

Path C:\Windows\cIIw.exe
Size 2.5MB
SHA256 67a9b0e98aa7dca8f4baf8fc13d74d47502750afc71b15966a063817c6da0ab3
MD5 a3de9de042ccc68ce430c014e9260381
SHA1 7592bbe8222a73b4ae3cd4c6ac1071a3e7d9467c
SHA512 3d5506bf4e9ae5df692ee166bf1554040286943ba59d6f96c42e3baab69a04916f7c85adf67a61d3bd7a3e3f38b076be42a51603644743c883a44a6dc4be9854
SSDEEP 49152:qLVyqmsOGE1+YRYfyFYdy8I/TAy6oMnlz/LTn6d6S6W:qLVyme+pI/YoQjy2W
TLSH
T139C5A23A46B9662926DF546885FA24FEB41033FB52DBE8FFBFC8A10C451128F1936147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cQAo.exe

Path C:\Windows\cQAo.exe
Size 1.6MB
SHA256 2fda39eefe6deb93fc1a4af968b00b81b2a699578a60634cd3a860f669302f27
MD5 49394afdf36ccd15b9919c9e79e6d984
SHA1 7244fe2fe92119ded0ecac0655b6763d179ab85a
SHA512 7b80fb76efdc2829852d67ff8a6c6237f5bcd72f03b1105dbbee56e90aed18d5b61391a654ee61b3e9f02b25803b50323e8a3338e7de6361c231c8f184224985
SSDEEP 12288:9ownmQc328MGqBLJLZmrZ7el0MhJV05SIF0r/ZeUTe+8yg5wry76KOhHcwd6ySWz:9ownVfBLJLZmFG/ZeQAwrehIHTdGU
TLSH
T1CE751F9BB015EF78D90DAAA34D406A5F343D7DF4AC836A778A783841944815AF480FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cQwU.exe

Path C:\Windows\cQwU.exe
Size 2.2MB
SHA256 4fbe9289a73d408e49818a8092a5fddb247d60157a60e09932e5e090203cf686
MD5 103f652d55258a3d0c9e5f7706e987f7
SHA1 79bd76641bf17c52f46ed53631507f6fc0eb155b
SHA512 87c9e461f609f58182d3170038f03510d079329cc9a6e40354cd6d1b696cc99c435f291b707cda74f5df46cfaf2153896856313dc7918e8301d23760692efc61
SSDEEP 24576:syJ2SijyF1NYngPXXDQ8tcWx9KgHNETZH4xyLGRjOG19TtxnyZ4:FJ2LyFEngPLTJHu1HMyOjOG19Tt0
TLSH
T1CFB52B15358CBD483008E99DF8565A90BCF0C7676DE80E320E9D96CAD5B85AF0CBD4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cQwu.exe

Path C:\Windows\cQwu.exe
Size 1.6MB
SHA256 b4a81d1c1dcf55342d4dd9ab87ab1550a3428b17b6c6e745317f96f546cec79e
MD5 beb8cfba92447d8c5c2eb2040578d58f
SHA1 c03bebbf42747354e3f396dc604e7b2180108214
SHA512 99e0a17ad45e25a59fbc99a1c2b7cc4232a5e49af11d36ea872d095358a73d318f7ffc05b978085bd5adee8b97af26e0b8b2eb0aa4b418df1a646a9b87981b5d
SSDEEP 24576:nnUZUl6/t8GIM4Qu4Bb+loAKAKlNCjji0VVww4QFhCz6w17JDH8AxPi3BWaFY:nOIFhCz6kJDH3Pi37
TLSH
T1E67568B613A42C09BA5EB38109BB1DA548AF9578FBF7F9242F9345CC5F0F86115278B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cYUk.exe

Path C:\Windows\cYUk.exe
Size 1.6MB
SHA256 de65bd0569b6ef75dbc31e63ef3e2130b5c953d5ba6778f7c6f003b92a46e1f2
MD5 5f13e478264efcbc91ddb192dffb5faf
SHA1 e24c9f0436fe22a3189435579976cc3295ce28bc
SHA512 9957973722a1211264d108742f3fdd8caff311fd0728eaa6dd131909394e4f906cebf9fa7ad66160f8a4e2cff6b2694a4f7b7fafe82c8a8ddeab89031aab55a1
SSDEEP 24576:M3Yj1ch+i2DvNMiiVPcEbVbhIK7YQMsQ8rSjw3D+jnlL5kc:Ay10+/vWdcElrKc+jnlq
TLSH
T1AC753070F8F8F83F16F2B58733B4EBFB4C7B5A445F6A02202846578496897094B4667E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eQcG.exe

Path C:\Windows\eQcG.exe
Size 1.6MB
SHA256 15809a29672846b2e8fb2dc3682648938c8dc44b701eaf8de7adb742b784f9e1
MD5 76e558822d80d64530b17ed38046c875
SHA1 fac605fb31defb88e306b442db4470698d932ce7
SHA512 17b1a40a0e8fa2fe3747e57284ff97858289b274936883ffb6ba3b6ec59edb6b1341107dbc4124faca079f7eda7ded8d26b9d673915fd9da74b67c3cb3760329
SSDEEP 12288:cemBYdwRHxTgpQvAQ6Jighm8E4Xojs+1DSm2UJkhAfklSfpOdMfsLPD:ceqHxTgpJThhfYhDSmfuhAfkYfsL
TLSH
T13C758893121CC417408F5AC4089991AAFA7ED86DD3EECC76F9D4C6D8712EBAC8F81B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eQgm.exe

Path C:\Windows\eQgm.exe
Size 2.3MB
SHA256 e1a635a161f8c6c35940589c9df30ff34434c51aa44e23503e76388f3bda35e5
MD5 914d070bde16df8cec35152dddb16775
SHA1 e60a71fe3f0f3fb141faa0dbfee5da2d68ce4bfd
SHA512 5819b1340bce454502badddd7ddf382e71958d6b49f123162f6b5302c2ed4e45862a2d3c1b5042207d3c254c326044a481b6a0bb2b7103b36732fcf99a8a8bdb
SSDEEP 49152:3+Jq3pSH8YubQw04oT3IUDEInBpLAOvQoLOYdipO6QUQ:3iq3pSH8YubQMoTYUDEIBpLpd8tQh
TLSH
T1B5B53EF284421402F6D99F96CBA70A265630E87F0BA5E778F10D377B55B131E9C0ABB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eUYg.exe

Path C:\Windows\eUYg.exe
Size 3.2MB
SHA256 77e4a9a0a8ff8472465713a1e1d782e60ed6de9a1c499ef330673b94ef1d1774
MD5 25413cdbaca1cb995c7bd56eda59f932
SHA1 33d936b2b08a532a8fce1629e405859120ba21aa
SHA512 ed03151e861dbb9d09d0ffefa76f26ea317fd2ab4dc0d90351866be587105d47761290649b0754896c97fd1b35a5128f9535fdfc48858115672fbb3c8eadd1a3
SSDEEP 49152:+fFlKywhKujhN3i93LeknFdv1S8DHe/99diwYuQcOa7l6pC:+9AyuKuNCHv1S8DHe/DMwC6
TLSH
T1A3F5E50676A224485C4FA09BB615C630EB0EC3131BFD51F6BD5087A79B0AED7650EEB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eYYa.exe

Path C:\Windows\eYYa.exe
Size 3.1MB
SHA256 e1eb9dc7d60e84d4fe2b9c67324585caf14c5249a955b25a7553f8fc4116258b
MD5 2e8e55880c4b70b5aff0027f4e5fee94
SHA1 72a2e1be6ba94eafd9338da87e6d55510c8c5bf7
SHA512 9abc7816c3f5bb536186e8c8df20b91ddc387e1bcc0deafec8c576608504fae5246f1f174fe8b17595144643f4aa61b444675de6daa420b7501c4e221dcfb8c1
SSDEEP 98304:i9ITs8lUC7K9NWU5a5TX9ciJm1b0z3GJ:j77cNWU5a541Yz3E
TLSH
T1C2E5E53238C8943896A127E518B7514BF6D2717C52DE21622E3C31DB214FACDE937EE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecgW.exe

Path C:\Windows\ecgW.exe
Size 1.9MB
SHA256 3267e476852342736e4f6a744382fe7108f9b2167074e06e7f7e1455c0fe9b0e
MD5 536380dece453673b7a59f9951b48192
SHA1 3c80096892156594c5344b9e1bbcec140d5ca428
SHA512 035bf2544eb370e27f182fcf8cdf5618dca98d72d9b180429bdfd2a04d29e990c697f38ce7687e3acce75e2d01f0f4ace120abded34b072df31be97c1925382c
SSDEEP 24576:a6wVfCXMpq+wVPw5/U3U4y5A12MOkOr5O8fYYBYnjPaS:aRCXkqHVPw5cUi2VkOrA8fYYBYDa
TLSH
T1F7950909EA1B3D8935AB7097B93037D079891AD7B0EDEBC067D8CE4404DB617CEA9C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gCAQ.ico

Path C:\Windows\gCAQ.ico
Size 4KB
SHA256 9a233711400b52fc399d16bb7e3937772c44d7841a24a685467e19dfa57769d5
MD5 383646cca62e4fe9e6ab638e6dea9b9e
SHA1 b91b3cbb9bcf486bb7dc28dc89301464659bb95b
SHA512 03b41da2751fdefdf8eaced0bbb752b320ecbc5a6dbf69b9429f92031459390fe6d6dc4665eebe3ee36f9c448a4f582ac488571a21acc6bba82436d292f36ac5
SSDEEP 12:su7zfhIVfhIVfhIVfhIVfhIVfhI6I6ItLUIUjajajaPcIUjajajajakfMIaITcjx:su7zwwwwwIZTLDGPTOBdcjtjmjFj+RIW
TLSH
T17091B79E538B5C34F95057F47AE5775296EBA60703CA2D2428AFF02E12AD9C17EFE040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gUQG.exe

Path C:\Windows\gUQG.exe
Size 1.6MB
SHA256 d2eaab629558e90dfa570464edfeb652674a2578ce7a1a5dd76dabadb9094e89
MD5 31b2e088c4db720df24b11c1471fe768
SHA1 cf144d0a1777e7bb86a2335ecd07159834e95a7b
SHA512 f7ba1e197d26a18cca142289abeba28ab55b4ef012a64a593c85202ed28b07423b54c458811cbc86447f6a6d082e3a715b4ecc97aed51a8bba09496b7d6d470d
SSDEEP 24576:qi6tEmIq4JjHpUrePxTM54Jj0TEw4CgUv62Y:bBmi3UiPxTA4mgw4CgUv6
TLSH
T1BA75B38C63F2149B99306BE17609EEF67AE4749F73B7051E897059093F23D928360F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gYEI.exe

Path C:\Windows\gYEI.exe
Size 1.6MB
SHA256 3a4f449a5cd1b14d53a284a1edb7a70b96b0f004eaf9271c6888891608ec94bb
MD5 94ec4eb64e82137f618133a411481850
SHA1 bac00258ef3afb8a6cffeb7bc1cf950b411f748e
SHA512 943583c78a8f430fc9a6acca7398cec45431182dae6a19d7aca84d21488a06716277d39e1223e1e2316240402bff0ed0c91defabd9425ec534d90ce5542555a7
SSDEEP 12288:XEF1Hacf4P0q3Yu5IXrtE2iTLtC8DV+HnVicF8:Uf6u4P0qoukq2ifp+HVNF8
TLSH
T1E37546ED68CC69F924DD72A0DA1D78C196CCCD2918073CBA9413B670DEC76BF35A4826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gYgM.exe

Path C:\Windows\gYgM.exe
Size 2.1MB
SHA256 c37ee0202211b2a42e53397dc58acb4a1886d72208d09c2fe7cac1d99fa3a762
MD5 4ce4ca5ebd380032ab009ada470797eb
SHA1 75d05ffd9d448a80fd796e6e22331c11de70dae6
SHA512 4724dd2ba22d4c510098c006bd1b0722862357da09841db638e17ec3a7b38dcba30bb7aa279a991b41e1c1ec07a845d9276cdab8160afd313a77c5a99d5c3ec1
SSDEEP 24576:Lhb7jSwPZAf28f5UF0RIwDAHFs+CprvcmMs2E54othA5vj6AUIMbYVgCbG:Lhb/2+8fqWDA++cr0mMw4otGHlgq
TLSH
T136A572B2010B7E2283F7D53F826EA160E7BBBA52EF893B43E3C0AC65154712457956C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gkcU.exe

Path C:\Windows\gkcU.exe
Size 1.9MB
SHA256 7e1f0e65394b12e5d0db3a4179bdc73deeac3b5c34ca24c7b2ac272b0669b505
MD5 18e6abf1ccf6464af957aad480109074
SHA1 362bf3747f573076c2a70d526b5aa93f6f9871a1
SHA512 fd4567e99555789102f890931b1d1130a9f04a0f20d8f464ecf7431cb445eb3497254c147ca5ce9ce8f151543838a3eae4e9c50048a5dd38cf3e5bc40173a456
SSDEEP 24576:2yZ86Q509N1R+EjsF0tI14xjiUra8Vj7y11T:2286o0tAd2k6d28
TLSH
T1E795E93B4AD9B58903138A14003DFE8486C4AD7E25B488F8BCD376489656DF5DBA837F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goYs.exe

Path C:\Windows\goYs.exe
Size 2.2MB
SHA256 39cac79bff35c6ed22dd13ae5f181523dff072e910b61b89ab3a2e07c2d75bfe
MD5 6a424be1ccca41a4a7be7eb8c11fa2fa
SHA1 2ef6040df28abe8a283b8a7c0e038d37f0f79e40
SHA512 16ca99786047d70437a2239442dca155b6be9bf4806a4ffc734dc888e182788bb5ca867f723fd99931e8ef7496f4488e0124e471571788e824be74c07c0f4c43
SSDEEP 24576:2K1hclR8fJLoZhHiOAJCcFty2ONeBEWo0bfzqcyi0PjxfJ5Oacg5Ki4+:NL3FeH2JCcK2OeBBqfnKb
TLSH
T10EA572C371E88980C30F9C7F2696DDE3360B86519DB21CD4FEB52AD7A127CA56D048B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gwkI.exe

Path C:\Windows\gwkI.exe
Size 3.3MB
SHA256 2befd7d46a5e3026e5484d40fd5320b1383de555e916b1a3991e88c1a2b8084c
MD5 3586148c0606c03301e16a70d63a5f8b
SHA1 3d76050dc5c32e913e994c265798089f18b248f1
SHA512 dcd0c8afd4313035a28ff274c29e6460798ed5f3b0ba3e3af6d2333ba1e857d803190ff012fb864e234b1dc5892060530642d3eef9b5316e9f9f786bc7d42bac
SSDEEP 49152:Q+oJ1IHxJRtRy0V0XjNg6eC5mY/ufHQ83tY2lZT49iDrwTDSn0RSL:Q+oJ2HLRX+PeqxWfHQiYbsrwTGnL
TLSH
T1CCF5C52E13ECA75D7EC02CA7EAD5DA30D07985356C6B67F5F979602F8218017130BE8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iMgK.exe

Path C:\Windows\iMgK.exe
Size 1.8MB
SHA256 7c9900f0b769078825d7ae64933bfa8379f7572064a5b46f7a0284909398551e
MD5 9f8b92a7331b976639af3251a2c6cb9a
SHA1 7341b745d99232ddc8a7cf4542671a30ffebb79a
SHA512 d5aa13f73b21f4a8dde80b28631cbe571d8b27cfc05fa960ed75c0a5653b8e08617d23920f09f6e0cd26e8a4f6ff0cb8ea059c8c8fabebbab77111d05d0f3fa6
SSDEEP 24576:vnLMDlo+bEqkkXdSwtp7nhlU19XEM+f/3IV/as:vXQXXdSwbnhlEyfC
TLSH
T13695B6768D8C48C5295D7E708E93AD6D16E907EA79E6CB370D5A0A3CBD00C80796F4EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iekc.ico

Path C:\Windows\iekc.ico
Size 4KB
SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
MD5 03c62b34b94a861c4f99017a91bc749e
SHA1 2ca36583370792d9d56be7e5db98417188adf5a6
SHA512 4260811ca36c05c15db789932b24767db68b0dfa1a0590e8d4f69328e208c38693e978d892e0d229756a8ab9092265e19b0a0da132f0542f8460be54ba6371f3
SSDEEP 24:su7zwwwwwoRLM4IRS00000xwbU66INLbXxtRmcjtjmjFj+RIW:tzwwwwwGLZ+wA6nNnXlNjtjmjFj+RIW
TLSH
T1CC91282223494C36F8D4CFF0AC9ABA956188BA544FD52EDC2DADF01E117EBF649F5010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kMUC.exe

Path C:\Windows\kMUC.exe
Size 1.9MB
SHA256 60a9e42a36873f98118e252b0eb950591ed83ff7269dcf9e4aeb6ede7a4946ae
MD5 0aa1ff3d25d6e8afacf5a6a18576af9a
SHA1 89f33428e57d585ac0027ce41a3ea4227c403e37
SHA512 dda2570229530a7bce2d35bfd5529ee03ea806e4f1e338b4483b584d5fe4343a51dfe828e83b6ef76097b43a4bda645f32144cfecaf11cd3b768e37bad11a3e5
SSDEEP 24576:lniMdcbjmWWGjkwCd22WBzP8iYcE6JHxmFn7wU5b2iwGE:4MsjQIBzP8iDFYtwKb2I
TLSH
T10B95CB406F05EC7F9303B61078021CB51F9E12AFE95F11B6AD106E4E667BCB28D6E96C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kQMk.ico

Path C:\Windows\kQMk.ico
Size 4KB
SHA256 5963420fd9ba8c8248e3f50d179dfa21caca8538ad1482a03f260b27cf218043
MD5 11f567ee7cd81363d091bd0a1e6e57b0
SHA1 506bacdc816e7638ad6cf2c83e40a3924a72d8c4
SHA512 beebe8b70fc370737b5f4abba21a2301fd5341c3295e483f51eb03d5207090f662d2e19d3fa2b534ec51745d3eb399ccf0f1969aa3ae80b0543849133a8a9dc5
SSDEEP 96:hB3cOiEOiOvss4EVCd3jtjmjFj+RIvqqqqXyy/X:8CdkvX
TLSH
T13A91BBA223090D3AF9DDCFF06C9BB65595493A404EED29DC2CACF06A217EBF609F1000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kUEs.ico

Path C:\Windows\kUEs.ico
Size 4KB
SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
MD5 7b65672ac808bca7c81e0700562aae9c
SHA1 e279f707d5f93cd0449443cf7f70d54a54763208
SHA512 7592be8433d2044e21d2e67cc5905f1ca3d2c05884f99e4fdf4db1aebaabb735ca1d50f6397d02ef2c0ba6e4528ec5fdc4592ef35e0e6d451e0453d5491345b7
SSDEEP 48:De3yb1JCOwbwKDo4fwmF6X3TWDIfA5+wY+wcY1Je8cDQx6k6uoE1k5:T1+DvZO3iMfaOJ18D4TC5
TLSH
T1AD91B289F71398E1ED27323498315D362F61AC27A8912DDE39C9F1A31A7314286FBC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mMcC.exe

Path C:\Windows\mMcC.exe
Size 1.9MB
SHA256 da14618c4a075048e2a9d7eaeda0e0de15118c11d98552e13fa189f8bcf66670
MD5 8e387d7650c1dabb8afdb1e3884b3697
SHA1 864164b3df0eecbdfd62e9f7ece7127af3c56dc5
SHA512 8a4abe72378fe46814bbf54410d085bc701688456755a0ef3d2a048ade253a432db76e20f744e391a510ddc5965cf70decca3eb8f770ee60b006862487d8c19c
SSDEEP 24576:Tbwgl8aQWsCCYCm5wdpqfvMpQRcOJzdf4KgI:Tbww83W7CwadzpQRbQKg
TLSH
T17095104E0CD9BF64A55F4A90774A3B86F41E1681CA3B202F291534EACD4BCC2CA55E7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mMsM.exe

Path C:\Windows\mMsM.exe
Size 1.7MB
SHA256 a694dd113ab469610ffcf4d0e477d87185300d35d383a5507595134297479212
MD5 b3145e5b613c36cf0a73c4f0b186a63b
SHA1 d0b93da19a6cd132190a813e6e6939919ecd41d4
SHA512 9debe097e6a7ba9209390769f24bdc8e5d69c9ca03b244bc9ac0ac3b82d6bb09a4220c64820b4ed3b29b685a5f78e8af5036d5ac760385a61a1d83f75a36101e
SSDEEP 24576:plDpkieb97megliPKZSQKJQHB3XLjepzU1R8qW:GiklCF5fXepzU/DW
TLSH
T14B8561D0AF6190BF5F56226AF488025B5CE2808565F0CB32DC0E269D3B6B8D5ADF3F45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgcy.exe

Path C:\Windows\mgcy.exe
Size 3.4MB
SHA256 82fc1fb7d06d0e9c0d2e5d1418397d93713fd08bea492b7b22d7361932d657db
MD5 74ac5e3baa821173c30c01808cb3a097
SHA1 ae3cd9b31bb3ac1fae60fd30e1ad42dd9ec64325
SHA512 4e7ac164aea05fdfdd3e4d9becd3490dde34964e80c028e4b1dbcdf79a4dbc0890f925f4616efcbc5199882f9b5b848435261f1057e0f09d036bde696ec50d62
SSDEEP 49152:OT8JniuvSW3or/wJKAbnAUwV08CTyK4J5f5mfofZev0353LEDablRbiQlnK:W8JndYrOKAbAUwa8CGzmgfZeq57Pi8n
TLSH
T1BDF5D5086067C932DC9F5DE838C9C1861B0D16DBE41B18A51AEFA4C5FE32D9C8E4E5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oAMw.exe

Path C:\Windows\oAMw.exe
Size 1.6MB
SHA256 7ee1783cecf4570c27a4bd82dfc524b81848386aa1b420101f514d8b42cd3ef7
MD5 f3cd836543cddab2a65ccfb74ba28a48
SHA1 cb9c45767fd0b61990ba9d1be55ff770c9db8fd2
SHA512 6437aafca7c3df77805fe1911f00e130519330ef4531a5a2fe398f23e8d5da699627b4d9a349a941f76cd7fde340bf60c9402e1061c7515c45b444e67d11dacc
SSDEEP 24576:MkXlUEuC3rMpNs1shAfWf4J0+kZYHf7b/:vUEl3rOKs6fagf7b/
TLSH
T1157554ADD819941BEE756BE430740F6D2073C76E80E6BCF65188909B2233245FEDA397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oIwW.exe

Path C:\Windows\oIwW.exe
Size 2.2MB
SHA256 923cbb1f1878746d891fdf24ec3401a1c4d79aa501e93b08ce87bdfbc47c20a6
MD5 ade181ade096a05d5e44437038217516
SHA1 0e9fe85b4c4a263c7eaa96b117485f29ddc72a67
SHA512 bd877146123e3cd07c4ffcf4a806150e9449b1627b6f46625184ee0a5d916e92624cac764dfadda1650644b0675b9c8263d6c716fed137ab9b7ff80695e9601c
SSDEEP 24576:bZTkau72l955vpX5XoTuQZzgg5TsXJDJZqNmL9vtvwFkUFb6elHn:bNua5NFVoiQ/5oXJdJB7Y26
TLSH
T175B5649ED0B21F324E30A15CAD8AFAA47D7241826E23CF47CF66D02FF156E45DB52909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oUMM.exe

Path C:\Windows\oUMM.exe
Size 2.0MB
SHA256 f470b9a00dbc638caadce16b7d29114094d23b3abc386ec3703efc7f974eb42b
MD5 9f97ae52ab6091e12085d70708cc58a0
SHA1 e4b35a798924b8b9ad2a9a373a6e1f29cc28ecc6
SHA512 87a92e951193768ddd1226994d1f782a6f4b76ce3812ab9fa5777d2cd7d147ea8c2729163ca880c4197c745550ff8ca67db72362c0f3198bf726e96049a91e2e
SSDEEP 49152:APhYBSApRZxYdPpvrOXWtuV7CCTGODid:APhWRZxYdpkdTQd
TLSH
T107A51FD0E1DCD28885E280AF92F04A3B5667F38AEF3992588CB7E1334DD5F6C5118D69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oogO.exe

Path C:\Windows\oogO.exe
Size 1.8MB
SHA256 dd4fe4f8fa31eebead78bea4d4683e134e44e93ec8bf68e50200cf48c0db973e
MD5 07fd6cddc935b8673e436e4bdeb2178c
SHA1 4db05b31bc5fd8724daddce61c4d4740e58c954b
SHA512 6ad567cf066a2254373808797130673adc3fb4334d116c8598036b7deb7552c2221177da4465831bd1f6e0686069a25f4ced8e3bbd1f59bbe44c4f6b4cd40e85
SSDEEP 24576:q/wLRs4YmJhVwPz05IqOAqVYoq7rqpITZXFLwRCSdSsoBCklRgi:64kQhgYvNXGRJSZBPlR
TLSH
T1A785758A3E86262FCF3040D434C5DB7AA785DDB201736A4FB9F596427F0EB886C1615E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ouww.ico

Path C:\Windows\ouww.ico
Size 4KB
SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
MD5 5ba7883f40b96f2cb26db5c9d431a806
SHA1 c1b4562f081d4f5030ae725b5f33a09ccea11bfe
SHA512 01a105c64ddbd4ee08e440d11ddfb6c5eb87b7dc040e07b735cb5b227895c08327d182fec4a170b26e92a7159af3f1da16551f2ef225edcf61daf877a24807ed
SSDEEP 96:J5mUGqcGqGguZuZwMgB3lfca7qHTTejtjmjFj+RIvqqqqXyy/X:NoWXB3Nca7qHTTRvX
TLSH
T17891763313880D3AFD212EF07CB696ACC5983A1882CA2C54EFEDF54AB47E8C109F9151
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qUca.exe

Path C:\Windows\qUca.exe
Size 1.7MB
SHA256 c4029f63916ba5ceb4b74ccddf1e3fd726e8cfa73540ddfe9947e0a742f610b0
MD5 7b5147dbd1fdff7e7495cbeca20a532d
SHA1 672981cb5d73c1e1e3defbb199e8cdcacf45560e
SHA512 64c6d0c30595d64f12bdac81be80bfe1a7b8f6a9450937ac6fe50354efcf7e732d8672a2537339023cb69c52662bd233dbf4678a6db73763b867a293db084c7e
SSDEEP 24576:QufYi6rej9EwwUxAH5lkXZ5Nces4kgma7:p6ICUxAZlkO4+a
TLSH
T19D85AC19C03472714C08D8E422474A466DAE6F5FBECC18DDB136DB632716F92EED29B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qYIM.exe

Path C:\Windows\qYIM.exe
Size 1.9MB
SHA256 561e37e78db9559b32b669fb01a47f127ff95807c39b79d05a22d216ca93cfe0
MD5 78b1121d5b13db32b578ab757a99c35e
SHA1 9f9b6fc73d28110e1b7d3b94fc71710d476d769f
SHA512 e22d5fbeaea49c577ce07c86ae5d7aeb388959206380c51ddb1bba547d5b7ba19c9eef49c3bfdf258919031a042f4e74f51fbd7f8f1c87ba5ed617da1bb01f3f
SSDEEP 49152:a9DX9Tjz28tRf7YkHSVTsL2ojf7PyOfVKVNBPGHKtXktnE6PYx:29Xz28tRf7YkHSVTsL2ojf7PyOfVKVND
TLSH
T11A95EACFD93EC4E7EB95A91E49952CDB4878AC28607D47C4003909E73ED13EB264674E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qYow.exe

Path C:\Windows\qYow.exe
Size 1.6MB
SHA256 2c5d613d4ccf32c792971bbdb912c97e4eaf7b871206e3bb75064261a3c8af09
MD5 cb46356d2f8555bb3e65a8d5d0142c4a
SHA1 16f67f0fa0722a902e7433b58fec545821bfc9d3
SHA512 50f4f38d3ed9ce97a27114a0c141805b6f8d932f03f4aea815f26968ca5f331684756037774ef15b8a34448589a015a3a51de98a7d15c910d74134ca660e0cc1
SSDEEP 12288:hUIT4O9tLn0tGTMXzKwcAdDxVT0nonMhbGggfXUHLP3+a7xYCoPfwmZYJUfmVaHN:KItOGTMXzK4X0noMKfXCLPNxY5IpYN
TLSH
T1DA75FC4E873E700B3A81830A7733697754E329B2DFA560CC2068AFDD03F5AED5855DA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qokM.ico

Path C:\Windows\qokM.ico
Size 4KB
SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
MD5 04e9ffd28b9cbb9ca06e99dfd0c7878b
SHA1 44d1ff600e81c6014965bb30684eed29ac7c538e
SHA512 22bf260e1ab53d90c8b3083cae8d9fcfcf6ee19fe30d61c6074ddf38823afa4bc6bd738441bdd3e221131f4e87a750c03f64ac78cffa5648cba737c0c623d888
SSDEEP 96:xB+p+3sHL25ogAJpogoMotGcz55Xxm/frxO1Q4Ni:xBK45LAJprLq5mCI
TLSH
T1A1919C6DD785C54EC0E94F76D3364C77E1679C2B8E79986E024C31EBAE321860829D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qssM.exe

Path C:\Windows\qssM.exe
Size 1.9MB
SHA256 4d3f17622a31293b4a2882760fc672451630ef9ba73521d7a977bd090dfd32b7
MD5 8102dbf9a093ac1c401574fc232ba917
SHA1 c55ec479cfbb12ab7fba18c5a889421c6e3a4ff0
SHA512 551f8721e765cb55711c416e38aebe229a85e96246c6bf10ebd44854f4b01fbf54d7744a5640113310320211648880831602045b807321235851a39af4e41585
SSDEEP 24576:xqkTpBb78mIxCQJRnbcAwWRYtoiknbK1St1gOc:xqm4LTHb3Ot36VcJ
TLSH
T12D952E52B26F6EC2E61FA69C598ACD73A07C41D1222FE9A454D1D23F570CE64B0FF422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sAcu.exe

Path C:\Windows\sAcu.exe
Size 1.6MB
SHA256 207db6c9512a46985de86c5a8e66988d3d6eaf39b29e7fd805102f18f27c3d5a
MD5 47c93e3c68e8d52cecfc7db9867f3b3b
SHA1 c4bed4491810eded0d8c28322d2bfd302f326efa
SHA512 844a4b525675dc9d89150cacc2d6cf5afe74d32b12a2c508e2ed8203faee5f905473a430ca3cacfe6bf405b97cb265d0bccbe8b6ac4545c1ea65da276435d37b
SSDEEP 12288:rgMQnE9ztPsSGaI1BZzYuZizfhOBoHHIVfhyAEWR5CQK:rgGtGR1BZzYu8zsoIVfhyZWM
TLSH
T15C757A382CE585029217053B33A7C25B757EDF90AEE0CAD3A37F9295CA46A7D5C73248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sEgK.exe

Path C:\Windows\sEgK.exe
Size 2.0MB
SHA256 820b73fd5149f4d2cbd89b91771de1b784a82534debd561188be0288ebc6dc10
MD5 86c57669825d18fc600fc72fa350ec51
SHA1 75434e04b8078bf0b327b63215a6ca57c4d53eef
SHA512 6f9b3aac5bd9a205e35412167aaf260b8883589c4858f839ad90f71ad5c9a44c984885116c1b351ad76bf10498877cdd091064141cea807f57de4658e69f9c2b
SSDEEP 24576:qQveax4JC8fvWLxx/M/cBReZnnCnkT4sv90QjCdlVweKG9B:qQ2axG8LxR7aZokTtv90zqGj
TLSH
T1DBA5B734724CB79B7B9726591BA83C1EFCBA1525765ED4CC29C8422FBC389D2871306E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sEwi.exe

Path C:\Windows\sEwi.exe
Size 2.2MB
SHA256 24aa8ef26913ec35aaf4f348f86d092742241ecb598984ac1474ee46560459d7
MD5 2140f2edf1d49820740bdb8bf1094a68
SHA1 6335138477e122ef5fd5bcf8a3f951efc4a5f17a
SHA512 9bccf63c64d9b64723bb465c65645a74f5d1d2666e1dfdf808594f7f3ba477e6946cb7d4404cf1f1fcc3fd7290de7b639cdcd24df0c0c5345c2de1f19ab8895f
SSDEEP 49152:XPZCYMBz+xRmiVZDwAOTA7KOH3Ga41Us:/ZCY6+Lz/zO9OH2g
TLSH
T1A6B550E42029C0DC3B56CBDD3278512B0A87BD251BCBC727D1DBB8219A9496D3EC5F68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sIIq.exe

Path C:\Windows\sIIq.exe
Size 2.0MB
SHA256 ca34be0b01d8e2b897aeb59c9a330aace8d70a742e916957c5dc000a060b61d4
MD5 07248f12a72f1537d2f2ba48c6dc559d
SHA1 4e37ac10ef841f16e5e3da40e066cf41d2e558c2
SHA512 d755403121ecc8e08a853545efb55539b0adfcfa18221b72e43235ba1c07eb6a99fefe795dbf863df18480ba4c3735c62a1d71112e60d8830430fe60347a26ea
SSDEEP 49152:aD8jVFQI28aKvlK3HIQx8HV/Hr0jdRYU0:aNAvvlBD1H
TLSH
T18095A9999A9BDA36091695D3F532E8860C1F69C8C5279FD53DC88CD2CEC2731E3A8734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sMgA.exe

Path C:\Windows\sMgA.exe
Size 2.2MB
SHA256 431c8d4f10130c61b16e5edda5ede12470dad9d9e5afe75380d245923950601d
MD5 b70f9f196b3bb075f8e08a2678b51873
SHA1 05d33b551cd1b6424aca99ecb9b5d94ac651a116
SHA512 0d52f91bd8e1bc457b652ed4f83556ec6f3fb1ee3f964b5e9d03bfe76996bc9b11272ae7448c84168e38a15df9a6250c0c9edf281eb3bdbe836374ed4ccc64c8
SSDEEP 24576:zb8ZJB5WDDCYMdIm9YMyHxkSvGYN1qoTBA2TRFN4yHW:zbEMDwdI0lgGm1DrFN7HW
TLSH
T14DB53062EDC3B19A8521C81754E0EBBCB9EC247C6E26D437AA63F5F76FF00601636841
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sQsG.exe

Path C:\Windows\sQsG.exe
Size 1.7MB
SHA256 66fb9a27e6f08b68077b599618bfb06ad1121224a8f228e3651bb7fcc5600813
MD5 1c78085b531c873f0802feae584b2d2f
SHA1 27773aca98a06e4d473631ed8b754ba7c3ea6a88
SHA512 96f9136d56a7bfa5dc4cc08035c6c13c4155be2d760e76f394b60c7eaad5bdc32e7a62f9edd40831d3b9586c2b4eff404b880cc9effe7564dddc5d6f9c5b1499
SSDEEP 49152:V90bfaqcbfXxVr1Nitc/OZ1sN8r4i4I3aJL+w:Vyb1AB4qJLp
TLSH
T15C854006CE8EC21049A49AF86356792FBBC99B662803F77CC5BC381991783F349564F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sUEq.exe

Path C:\Windows\sUEq.exe
Size 1.6MB
SHA256 21cf667a5b1bd572ee02817542bd30eb5a635e8d6e2ed446f4652136d5d91492
MD5 1d461e9912fa9f236673a861aeed35ed
SHA1 4ecca42663822c8d62df6a5740c7b60fc834c008
SHA512 3d3031ed15c6a3580fe76446b813484167efbd9a34618e6abadb76309a78e7060f8c95c2c51be7b88da412a7c20e287998c1bfc84514909ded40ddd48809d596
SSDEEP 12288:LghhfbiGTNN+p0JXtUjuthcEL0R1aw+0YFQ86ZK2ScxEtwSMbv5pyXt1FCYhK:uhziGC0JX9HcFR1aw+VKK2HEeSMTOPr
TLSH
T1E5757595CC17CF6FA411B15899C913F2B2F4BF620AFECA7D58BD1D6E820E96842D0853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skkG.exe

Path C:\Windows\skkG.exe
Size 1.8MB
SHA256 bd1718f0fc1ad4196db4a9541ec3c56d3ec12628f2213e0265fab9da78fe86a7
MD5 47222d9e7de353577c5994cee9cd5932
SHA1 14725de519ef0efba8fe9c69cfb9c88dccc55968
SHA512 f3048259bf1fb77e260380bcb4c32c4ec3192d4a92e0c7542247079cb5e00648e3b24a499ec046a0c25e1f45e5fa4e367f55c62108ce74e692732ed82fd492d4
SSDEEP 24576:8VpKKmOcr937qRfcAvGK2O93pba4VdQI0nHkJIgOjzAiFD:gzX51EHJjEAD
TLSH
T10995DA19B2D34F6D592297332227943F3DFC712C2DF26186617433184DE9EAAE196BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uIwM.exe

Path C:\Windows\uIwM.exe
Size 1.6MB
SHA256 b66cb885124c74a918f99678037de4da312f19956b4b8796532b65d934d69d2f
MD5 453ed03f9b0d1e60d3c9305679fa7040
SHA1 a4c7ba8d94daf2763930353530d2ffd6a82fd537
SHA512 1b6a75ffbb4c8ecab827de1d553d35e8f46c7275f9530d37bc09d7b75fc9063fd3e4e9f8cc14a58e75b3312694c77788303935c527cf46160cc21e1257d7e557
SSDEEP 12288:Ev1NrMNmT46ihO0bYxe+zYjW5x7aTqCLYli2oRsbfyWCNTCkS:SNrom/ih9djWj7aTXsi21KPS
TLSH
T1DA75A93A5158F378CD06AC25F4B62C96709DF3808FA5509EFEDDC2BC60E7B4469A19C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uQku.exe

Path C:\Windows\uQku.exe
Size 2.2MB
SHA256 367459682f1e38fccb00b938f9e656eae71c29bad99b4f1c09eecabeb0dfe399
MD5 b4e52aa434fde7342d3750d4b1fd20eb
SHA1 ee878ba0d5eaf345109f5c316fd7ba018696fe26
SHA512 9e09e9f164b585e0d171867aa17690eb68f0865013634e785d7ebde31cbd57761301040fb60a8d3f4c43908a1390ce8e657beb87095267491f7e14e839ecdfc7
SSDEEP 24576:zJW1e2KW9Ev9/6Yxp5bYMzwOKkOTq/LPLoBVkc3sFb4REN7nHVnwi:zbISkU5bYMEPBTq/LI93w48J
TLSH
T1CEB520B8605BAE114D02E97BEF1E8CC7AE18FB4A3B7532926C67C3CE9643818D57444D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucAg.exe

Path C:\Windows\ucAg.exe
Size 1.8MB
SHA256 47e344766d152c7b6ac84fe0db2b61a52ab3d9cedddfe2153673308091bc8fcf
MD5 49bd6e92ef687c44afd24dcbc3e9d2b4
SHA1 cf400b245eb5debb88f4eed63bfcbf62e4776cb8
SHA512 a08518dfc0bd2b47af58fd177981d10808cb9676f79eaad6e887bf8ad74d23bf759ca8b3b2c06743377b3fed94c5851c0135269957b0a6264b59b47ae7dec5b8
SSDEEP 24576:LJAge0Z+ZttPcQYtBIvC3GL4SUFuWO0+Kn+Mss+mt0BYOu:izJ/a2L/K+D+eBg
TLSH
T171950EE5CBBD6E2812B7D57BD28CEC1F4C2C08B159E1A514A27623380DF25AB1F1B536
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usMc.exe

Path C:\Windows\usMc.exe
Size 2.2MB
SHA256 38de5872e81e9dc135a0bf9a91faf4e162bd081a9a0f94e45f39554493db4e58
MD5 724e95e14522791b42ec7a19ec880c54
SHA1 d55b6e7ef4e062ba3deea82517d5542b26a7f5dd
SHA512 60dcb2703ec0034dcc0cccfe9a8905bf644b823fbca84d92c04bd7b4906ad9ea8384d8741be3859eb4b7df53bf3edbcd132ee0916cfcbb7a795e74fb811d574c
SSDEEP 24576:HTF6dDt8QLofjs8jAmfBshrdxtC16gsaGd7+C9YnsuP2w:4b8QLijsC+jMGdl9Ynsh
TLSH
T1A1A5741E3565BBFF363B5D1C02ECBE540BA6B9729245B361384893CC8F1388A247979D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wIUi.exe

Path C:\Windows\wIUi.exe
Size 1.6MB
SHA256 dc34e41ac4fcf9c4d1c0ab1bbdd210bfb8d67e09de69f859baf2b48c21e0e44a
MD5 1dd39a971d62f60e6d6c5bffea559ab5
SHA1 8c979652854294da7e3e1d3e931e239d2b47a632
SHA512 4e74e204185d6b3c6324d06db706c055c3e60285e7a5e1667b1d65c1edacf94cca6c95eb59a5b06ec91d410a0a2581ead230b77735037979f1d30a683deedb9e
SSDEEP 12288:hejRWTcz8TZ7u0Ccq1OQlSsycvMuRAFGY+LOrl7aH2cl:qMO3Usz0uaQY+L2lOWS
TLSH
T1BF75DA16340F7F6D85412B20EB59A358A4EDACF3006EE594DD46FA8C75CCACB92D0B6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wIUs.exe

Path C:\Windows\wIUs.exe
Size 1.8MB
SHA256 2dee9edfb028293acad624755f0bb11fb4889b49dbd4d0d7512ab05e0234f1b1
MD5 48afd5ceddd85fb5fd0f8f375e0613b9
SHA1 bf131a9f321ad844c6473e9d09cf6d84399cd597
SHA512 5a46c6b6bce08bb55e1de932453e2870ded74e0cf5160d8864a28cf907c3504e53d37f7fd0a545705ffffdbb502e66dda52c168146ef68a7fb0a8dbb3a347eac
SSDEEP 24576:Rck7hWTV/bsySGFqarLzWxnFTqJlH3W1BY+mX:RRhWThPbTrLcqJEWJ
TLSH
T17F9520A402F6641C62A2EBB05D77704DF0DD8D3E61A4E5CE074C814ED4F46BA2A778FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wUIg.ico

Path C:\Windows\wUIg.ico
Size 4KB
SHA256 114dae4c54ca426f78e50998727dac92942261d71ca5b2dbaf413794dcf8ad82
MD5 951d9e1744712a1cab7a5f3f15935229
SHA1 ab3fb88a9610c38adb58cc9542db16d4f452cf6f
SHA512 9577444338ba09d5b16386100612c7e3ecb897d8ed4801f5992ae4522e45603b797475c15cd29c72446d19ee3ee9aef9a3d82e98657051b2377dbb4925dce6ee
SSDEEP 96:lq/kQ4MQ4QrYccsfaxjhjtjmjFj+RIvqqqqXyy/X:pZvX
TLSH
T13C91D06E138B5C38F45043F86AF6B75056EA6D1747D36A242CAFF01A927E9C13AFE040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wgsE.exe

Path C:\Windows\wgsE.exe
Size 2.3MB
SHA256 f4890caed9e35f2ceca899216114caa4b6ddb053c6b259c7efde0d989f5d6ea3
MD5 a128120b3e7e3cc93ecfe3c63b4f41a2
SHA1 e31e8d499fff311daa3f53c9e3d45f3b8953ccd8
SHA512 c1ccdfa38be59efe6cb726ff7da9565fa361baad75144a432935cfe3a4f49f68189b4edf538e91fe823149056aabb7ae37327dadb83167ffb78b88534125731b
SSDEEP 24576:QPk3Sf+i7KwDOFdqrP2G5ZUR5Eje7NJ8xw12Sg7zqyycM+TveBS8:b3mz7Kw28D17UyeJQuzgnq1cMh
TLSH
T12EB5C8AAFA83AFB119C740D7597420DCED32273F40CD9DAB74F101A705A7E698B1A25C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yEss.exe

Path C:\Windows\yEss.exe
Size 1.6MB
SHA256 e6549af115d8232e10c9118b3788135b806d66e98c0b7c0b54f5bf57e3d86325
MD5 07a305a5b752efa1d49ac573919ad947
SHA1 f52ac5d5a9565be43c1234dabcc1871896812b1d
SHA512 47a7e36b213c2557354d28b412b8f7881b90cfb0fe7f0b939837355b04095fcff8ca1db1fb29b75ecadc86f02a496d839ef9fc50813ac598f55628a6005d4688
SSDEEP 12288:Da3NaNKLWn9sPKb4Y7oKdqnIeyJOarNwLgQPIcmP3aFhz1zl4L5VG8z9pM8o8Hhs:Da31LWn9sPK5ML0FyFXxaVNDj
TLSH
T1AD75AA00B4059C550141A9B2748BCB79F36B1D74F39A8ADEC1E689BA0613A2FC5DFF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yEsu.exe

Path C:\Windows\yEsu.exe
Size 2.0MB
SHA256 463149507a2730b6b6530671f08fba44d6dc68b2ff99671479550fe8bab5addd
MD5 833cae279d59df14a433196c81a898ae
SHA1 65c37242056c30bc28ce18edada97fb70e156d3b
SHA512 02aa0e6549b230c50b94be8fc2dba93cbdf53b8d14bc900251b373f08ec2e0b10e04b9c44d56b7b9d018cdfb6f5c26fa4a5c49e99591b68500659f1aaa00b6ef
SSDEEP 49152:K+sxgkgsteLlR2xg2SVCwYBhApjCs8A8KT0t:KzxAnlRsTjFopIA8Kot
TLSH
T1A4A5655E0F3A70527B2951A1DA1B2F72177B2377C68C44BC90AB6EB131ADF447A84C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yUAo.exe

Path C:\Windows\yUAo.exe
Size 2.0MB
SHA256 4f95ea602455ac791998a65484d4f329f8ad5c36be826f32104c2d1cfe53e138
MD5 540b18561fd7ed3e1c89e5378f245916
SHA1 d866ef1717b633503a0a0950264e99354a5002a5
SHA512 ad7584a3f5814ae3b4742848d6d971677a6f1826b59bba05615d76da590dd56dd4e237cdcb14154e1ad1da7d5f52f58b9839ebb90e0dc47451f58b45157b0f28
SSDEEP 24576:0sKNnKSuNrAwZuIZZUMjb3HE+IQKROGhMTF9JG7+0FBhg12:0ZNKSuOwZz3tCRwp9JG7pBhg1
TLSH
T1C4A51DAD1C28E8F909D9511F260130734D364AB257221CBFA591ABF1E7783FEF9254E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yUYs.exe

Path C:\Windows\yUYs.exe
Size 1.6MB
SHA256 5a743031f459fc9caed2449bfae2f24ba988411044cca57e72c5d649ab6d1367
MD5 f3069146bf7f906933868087ab432714
SHA1 2c25fc89ab0da8ac4a067e7450bb34aca7121592
SHA512 9d080bcdf4b490bd53d7dc28152f3bc7aecea029d33cc6a49f4a3263af743e6657e8e33910ae83893f6e84b393490925ab88cdd67e2ff4ff8dd08413363d0db7
SSDEEP 24576:o7qdeiD/3NnAhAl7Vw7P08bWb4iap36Zw:o7qdeSmi7VwtKD+3q
TLSH
T11075D8D29ABA958990BDCDE49BBF6324DD46FB2B711EA548383F0154C261F1BD2BC430
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yUoc.exe

Path C:\Windows\yUoc.exe
Size 1.9MB
SHA256 e970cccc634d6872b6ca10701ccfc18dc62dae74894899a1b514ebead182d265
MD5 5ca7785a654bd80bac3b4ced80728211
SHA1 eca06a1629a934367e8cec533afcdb2f08897ead
SHA512 15a512bf99b14552ec873f4557707c85ea49cf60cfd324f1ee68b283a9b6629071e7123160610cfed2a255e73d0418712bd060117585e026f1a962a244aae1ec
SSDEEP 49152:/byPZtL9vHiwaCvbzrxo3HaayvBEsKZkJ:/byxtLJiwaCvbz9e6ayvBDKiJ
TLSH
T13595EA37C9BD419AB385E553885E9B87355B1902F2DDA033AC8A851B7B4837C0FD72AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yYoo.exe

Path C:\Windows\yYoo.exe
Size 1.9MB
SHA256 ceecbc37a533bd9a904fecab64eea88effe9715b0d0c0724f3c899070f3de80f
MD5 9e96a5fcfdfc777e1c8edf94204e41da
SHA1 1bf49b3dd0c6f7005d74701afed43d9acffa394a
SHA512 83c9f936264aac8261515a59f47101564f2b9f00bfc71ea75b0661522d5d204af4b60f718ffd68b64c7478b56647d6e61254240969335237a976bdb7407ad3ea
SSDEEP 12288:OeZGsD2l3vKtYkCGh87eZeB7Aabn/f1Jpf8hw0FFfYfowWtZ:hDqUzCGhw7bT/bpP0Myt
TLSH
T1289531F4B180D19B33E868B414E25289C49B0719ACDFA49EEE729B3DE1F9F94E4D005D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ygoW.exe

Path C:\Windows\ygoW.exe
Size 1.6MB
SHA256 f8afb4140a37f1356a15052b9de2361c286476a139263ebf7c32eec7afe328a4
MD5 8d76b8f9e856b71b01d46f9602a4e9f2
SHA1 c5900a20d5c576d9ab102dfa7b1f5618b0510444
SHA512 f9609e3054c33946fee871962b65763c69e6cff3fddad23e414f65665b4b9d27064fec93b4d8da226990c5ec8220a493225f32d887d631aff96d880586ca39aa
SSDEEP 24576:lTAKFUckCoycAYJIfMwE5yTrO+I//Fqg:lExck0YJIfY5yTrO+I//F
TLSH
T19575010D5ED32AF89995C84CAC11816D78E869E7939FEC72245CE283FE5675C022F4EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yosc.exe

Path C:\Windows\yosc.exe
Size 1.9MB
SHA256 30d24b0e299835722fa7cf23ee98241b7866e7b39f1a7055eef3dbd4b4919d23
MD5 0441852b1ddf0e0f583db4d5472a5b1d
SHA1 6d823c05cd621439730bcf22f7cf48ac06fab564
SHA512 e875ca791d8bb997067154973d249a0df415cdab40f321796faf3292575f24175b3c97b68df90c3b66dab100ff6fca9ba75ce5c073e987369e8d8f86c5d7b792
SSDEEP 24576:SAv+1WhChmO0sPv/xVhapDHslUgwcB6uYR+HbN:z2qKH8pDTgwsXHb
TLSH
T12295B93149E2292CBFC759CE85EFD0373569A9BE009E3450B4761367F86A320579BCE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywcy.exe

Path C:\Windows\ywcy.exe
Size 2.0MB
SHA256 fd7ee9fc07ced18c6cb33084919b66e4732c942d0cb136e99db934c53607e8be
MD5 640ebf649a1a1a5b3782843026d14c9a
SHA1 bcd6ddccfd8437e92fa725950ca80d2403487694
SHA512 97cdd777c2f4e0d1b8d1ff2eff38ce8d88c76c56676938ec2b3f3c9b5bc2760fe569dddad4bc03c0048924d28e4ef4df5103f9a59864bedf777931d4833c0c0f
SSDEEP 24576:F788nWOmAgMHNYC3bkDAPmzX1jaos9omKbgvFQzZ:FfWOmUtYCADAusos9r6Z
TLSH
T13BA5DB10C02EE68FEC6664B74CD2959119F3019C3FAC9FB4830455AF66B65F83E7AA70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1200-250-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/1352-160-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/1496-1943-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/1496-20-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/1508-1953-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/1752-203-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/1964-129-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/2148-464-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/2204-112-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/2292-219-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/2468-68-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/2692-272-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/2764-239-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/2812-33-0x0000000000400000-0x0000000000591000-memory.dmp

Download

memory/2812-1948-0x0000000000400000-0x0000000000591000-memory.dmp

Download

memory/3076-373-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/3276-529-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/3740-173-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/4164-189-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/4184-97-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/4788-7-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/4788-1933-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/4796-0-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/4796-30-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/4796-31-0x00000000008B0000-0x00000000008D0000-memory.dmp

Download

memory/4796-1-0x00000000008B0000-0x00000000008D0000-memory.dmp

Download

memory/4812-230-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/4812-218-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/4924-85-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/5700-53-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/5976-141-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/5988-1938-0x0000000000400000-0x0000000000591000-memory.dmp

Download

memory/5988-17-0x0000000000400000-0x0000000000591000-memory.dmp

Download