Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/08/2026, 11:16

General

  • Target
    2026-08-22_234672fc98d425debae53b1bb25e6944_elex_virlock.exe
  • Size 206KB
  • Sample260823-ndek3awdkc
  • SHA256 d283ce7d6d243738fbdeac744f8cf3a97bd954b28fa0f750c354dd033252fed7
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • UAC bypass 3 TTPs 1 IoCs
  • Renames multiple (82) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry key 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-22_234672fc98d425debae53b1bb25e6944_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-22_234672fc98d425debae53b1bb25e6944_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4228
    • C:\Users\Admin\vWEQwMkk\xEoUIAog.exe
      "C:\Users\Admin\vWEQwMkk\xEoUIAog.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      PID:3696
    • C:\ProgramData\QSkgkoME\aWYAsEgQ.exe
      "C:\ProgramData\QSkgkoME\aWYAsEgQ.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:3852
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\newfix.exe
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:1412
    • C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      2⤵
      • Modifies visibility of file extensions in Explorer
      • System Location Discovery: System Language Discovery
      • Modifies registry key
      PID:1520
    • C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry key
      PID:6012
    • C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      2⤵
      • UAC bypass
      • System Location Discovery: System Language Discovery
      • Modifies registry key
      PID:5664
  • C:\ProgramData\QSkgkoME\aWYAsEgQ.exe
    C:\ProgramData\QSkgkoME\aWYAsEgQ.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    PID:2076
  • C:\Users\Admin\vWEQwMkk\xEoUIAog.exe
    C:\Users\Admin\vWEQwMkk\xEoUIAog.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    PID:2476

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        aWYAsEgQ.exe

        • Path C:\ProgramData\QSkgkoME\aWYAsEgQ.exe
        • Size 179KB
        • SHA256 1bfec7983165c125125ffb5dec7b8c8fe5c3820f59c575f3081e82ad20716ce2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AAcW.exe

        • Path C:\Users\Admin\AppData\Local\Temp\AAcW.exe
        • Size 206KB
        • SHA256 35bf30fdc3f7a815e07900329efc7386ab742bc99e5600eb0af75385d2b1e600
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AcIe.exe

        • Path C:\Users\Admin\AppData\Local\Temp\AcIe.exe
        • Size 1.1MB
        • SHA256 96749c54da5d7c3a2caacd7c1f6cf3aa1e2d67b1c5a5695503f1f64804fcaf52
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aggo.ico

        • Path C:\Users\Admin\AppData\Local\Temp\Aggo.ico
        • Size 4KB
        • SHA256 bc4ed7d844af9da0a5d2fe12e8db07fbfdf6e0ecd557223b292bd0e9cb6a64a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AswW.exe

        • Path C:\Users\Admin\AppData\Local\Temp\AswW.exe
        • Size 885KB
        • SHA256 2febeda4b36ba6f5d03d6062000aec5badfdddae74bc20ff2667ca73959f9309
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CAcu.exe

        • Path C:\Users\Admin\AppData\Local\Temp\CAcu.exe
        • Size 197KB
        • SHA256 68afa7ba6339fb5e34736a3d5dca6d916959ce3f1a556ff0b7d06ff3a6bf7314
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EgEW.exe

        • Path C:\Users\Admin\AppData\Local\Temp\EgEW.exe
        • Size 315KB
        • SHA256 6a8d8db94ebe6f72870056a78c4736b4087b5f78ad00526522fd601d2d18dbee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EgUC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\EgUC.exe
        • Size 181KB
        • SHA256 b6e0b05f79056385af89b9b95e2b62c7ff86eabb03175805a4572761fecf7772
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EkcK.exe

        • Path C:\Users\Admin\AppData\Local\Temp\EkcK.exe
        • Size 189KB
        • SHA256 4b563457911e24dba7fa2e3b65bb0eac39bc03756233e96a3d9b441cde59154b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GQAs.exe

        • Path C:\Users\Admin\AppData\Local\Temp\GQAs.exe
        • Size 614KB
        • SHA256 ea85eb5a634a721b75a629a0b0d7d4d7610a184e5ca6d225c5d34925a5ce9743
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GUkq.exe

        • Path C:\Users\Admin\AppData\Local\Temp\GUkq.exe
        • Size 198KB
        • SHA256 97ebd78dea36da00ed3ce03b9a3861a1549730026e516c0d067e1d3c47c3ab9f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GcEY.exe

        • Path C:\Users\Admin\AppData\Local\Temp\GcEY.exe
        • Size 581KB
        • SHA256 c83a23d314c4937c6945e301c045bb833c285dec9dc3c0ddc34244bebcac299b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IUQU.ico

        • Path C:\Users\Admin\AppData\Local\Temp\IUQU.ico
        • Size 4KB
        • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IcMo.exe

        • Path C:\Users\Admin\AppData\Local\Temp\IcMo.exe
        • Size 589KB
        • SHA256 265e797e2f693e301f4f62abbe87397d8312b0c4977b12c4bf47d7b6490c1a15
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Ikoa.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Ikoa.exe
        • Size 454KB
        • SHA256 a32c60cbbf72550f0542d064891011dac75e811ddeb306ddd665a237aed9fc42
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KMIY.ico

        • Path C:\Users\Admin\AppData\Local\Temp\KMIY.ico
        • Size 4KB
        • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KsYo.exe

        • Path C:\Users\Admin\AppData\Local\Temp\KsYo.exe
        • Size 218KB
        • SHA256 0c0edd968d8cf8a295ca4064e2545cddab783bf7c8df8b0837ebfd52ffd8d022
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MQAQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\MQAQ.exe
        • Size 406KB
        • SHA256 209aff2c73699d0d1905ed2150b6ca7cc699580270e4e215239c43d796c1e07b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MQUo.exe

        • Path C:\Users\Admin\AppData\Local\Temp\MQUo.exe
        • Size 522KB
        • SHA256 1fcd7e413ac3900c473eb3adc2727a19f5b056c9bc847b6375838014ab400c05
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Msku.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Msku.exe
        • Size 508KB
        • SHA256 3cf5aeb62e3cb794daa32c3111b015b373e278a22e57a907098d076202ae1e88
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MwAo.ico

        • Path C:\Users\Admin\AppData\Local\Temp\MwAo.ico
        • Size 4KB
        • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OAkS.exe

        • Path C:\Users\Admin\AppData\Local\Temp\OAkS.exe
        • Size 614KB
        • SHA256 55d8f3405214b228cfc3499cccb1cc20ba0c4a09c82cfc5c04194aca081f0ca7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OUUS.exe

        • Path C:\Users\Admin\AppData\Local\Temp\OUUS.exe
        • Size 377KB
        • SHA256 202459aa3d28710628533ac39a3a3f8fd25ce3f3c4b205bb3f48f69673e73644
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OgEW.exe

        • Path C:\Users\Admin\AppData\Local\Temp\OgEW.exe
        • Size 224KB
        • SHA256 4f62df0d06ed44a56cdd20b989f1e2096df9333bbec71a17bb97b3099497aca5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QEMo.exe

        • Path C:\Users\Admin\AppData\Local\Temp\QEMo.exe
        • Size 419KB
        • SHA256 259adbab45b0262972f839785efef98143e16d0cd2aaecd4235027d9f72cfb7c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QQUm.exe

        • Path C:\Users\Admin\AppData\Local\Temp\QQUm.exe
        • Size 638KB
        • SHA256 e62f8610d7f49057a56c209dbc7463123a075dc362547e7200bd6f7f42747b74
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QYMa.exe

        • Path C:\Users\Admin\AppData\Local\Temp\QYMa.exe
        • Size 205KB
        • SHA256 dca1d2a6f29308946b81f6199b222cd846804f5bc759e3f40b7699d4dcbab3de
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QoQS.exe

        • Path C:\Users\Admin\AppData\Local\Temp\QoQS.exe
        • Size 189KB
        • SHA256 2722271347311c638bc46ef001dabfd2e146949f635450140e8632fc7885bda2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SIMA.ico

        • Path C:\Users\Admin\AppData\Local\Temp\SIMA.ico
        • Size 4KB
        • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ScAY.ico

        • Path C:\Users\Admin\AppData\Local\Temp\ScAY.ico
        • Size 4KB
        • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UgYS.exe

        • Path C:\Users\Admin\AppData\Local\Temp\UgYS.exe
        • Size 442KB
        • SHA256 b9fb5d8a4203815c01fbd93c3a2d78fec9ab8a757c98664c109c53a0093091e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UoUa.exe

        • Path C:\Users\Admin\AppData\Local\Temp\UoUa.exe
        • Size 231KB
        • SHA256 7e4548a6b46d399d0c9e32db105fbda94584d2f49d4dcfd3e2f6e1b805d232b3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UwEi.exe

        • Path C:\Users\Admin\AppData\Local\Temp\UwEi.exe
        • Size 1.3MB
        • SHA256 80b96fbc34edab4a4a197b33b8feea39d2d16160bf765605ee79c771dafa5133
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WcYe.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WcYe.exe
        • Size 372KB
        • SHA256 bf39c8c8b38c019a845006c393ddc8573df8f1ed7d0fb15634228412c1fc0d18
        • MD5 SHA1 SHA512 SSDEEP TLSH

        YAMO.exe

        • Path C:\Users\Admin\AppData\Local\Temp\YAMO.exe
        • Size 203KB
        • SHA256 d1b9771f8dfea3d393bd60a6d7b35fb8e7617759f572a1260cabc59e0b8b5faa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        YIMS.exe

        • Path C:\Users\Admin\AppData\Local\Temp\YIMS.exe
        • Size 636KB
        • SHA256 56c39002029aab502a6ee5a5ef3a4f230710e450f9a5233f8d14062ad665dfaf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        YIMk.exe

        • Path C:\Users\Admin\AppData\Local\Temp\YIMk.exe
        • Size 225KB
        • SHA256 55f7fc123ca81cacd1376d2fffbd25314864421d26b63be8c7074ee1f55eec2a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        YQkW.exe

        • Path C:\Users\Admin\AppData\Local\Temp\YQkW.exe
        • Size 207KB
        • SHA256 62d5670e2dfe02467c622301c3c6542e9bcafe3b1f1ca89c17f2edb41e4ec1d3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        YUoO.exe

        • Path C:\Users\Admin\AppData\Local\Temp\YUoO.exe
        • Size 521KB
        • SHA256 669a90adf3a292c07a59c232c9816852fdf47281209231c378c4c09867b332a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Ycwu.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Ycwu.exe
        • Size 899KB
        • SHA256 528b182e2746d8c012c7fadba9c6c7f82be1b16f6ca16b3504f93814046a6196
        • MD5 SHA1 SHA512 SSDEEP TLSH

        YgIK.exe

        • Path C:\Users\Admin\AppData\Local\Temp\YgIK.exe
        • Size 930KB
        • SHA256 7521ac84e444572aaa1c226d0b43fc6320a04050deb83dbfd1b65caca3ec164d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Ykcw.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Ykcw.exe
        • Size 401KB
        • SHA256 ecbd4514b275cdb2d6349b28d31b7791e9583267aca841bc0893f961cea8706c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        YokW.exe

        • Path C:\Users\Admin\AppData\Local\Temp\YokW.exe
        • Size 1.8MB
        • SHA256 798e00b3f2c23b64f44e449e55497c6395df0d14b4757d5613e7343d336cb87a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        YsUU.exe

        • Path C:\Users\Admin\AppData\Local\Temp\YsUU.exe
        • Size 535KB
        • SHA256 c756cee48e0d269791f8df16c05ff7e72421214deeb1d06362d1eb58679c4288
        • MD5 SHA1 SHA512 SSDEEP TLSH

        aIQY.exe

        • Path C:\Users\Admin\AppData\Local\Temp\aIQY.exe
        • Size 629KB
        • SHA256 ed44387c2aa84149cfe703920ab85d686dc6a55aa35f2aeb5c484c5ede81e506
        • MD5 SHA1 SHA512 SSDEEP TLSH

        aQgK.exe

        • Path C:\Users\Admin\AppData\Local\Temp\aQgK.exe
        • Size 201KB
        • SHA256 09a3900d7c88f152a2d6722efc284bfc0917c8100fa89c24221749f6cd40e6da
        • MD5 SHA1 SHA512 SSDEEP TLSH

        acEq.exe

        • Path C:\Users\Admin\AppData\Local\Temp\acEq.exe
        • Size 184KB
        • SHA256 66fdd7f94e0b7354de6063402c8e83eede720ceee6e3e6b5687df895d59de626
        • MD5 SHA1 SHA512 SSDEEP TLSH

        agwI.exe

        • Path C:\Users\Admin\AppData\Local\Temp\agwI.exe
        • Size 600KB
        • SHA256 5bb2a7434dabeff5fb0f50569abc691b017d5ba55a6ef30742008022052a238b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        akIY.exe

        • Path C:\Users\Admin\AppData\Local\Temp\akIY.exe
        • Size 244KB
        • SHA256 e4392ddbdceb2f0a6e5bf0300d21bb8cef52066e89bae1843ed2d6ae36a25d8c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        akoC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\akoC.exe
        • Size 358KB
        • SHA256 4a06d8522056637f86ed240702b12b734be41d396c18fe1e78b6476b0434c811
        • MD5 SHA1 SHA512 SSDEEP TLSH

        aocw.exe

        • Path C:\Users\Admin\AppData\Local\Temp\aocw.exe
        • Size 191KB
        • SHA256 7976fe5a38888fa2b64bb0b3d1c7bb827024d6b96476270f927c2685b767075e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cAEC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\cAEC.exe
        • Size 541KB
        • SHA256 2467e7c71a4b8e44de0e7df0b292b22335f2cb4208e6e0e5bf67de328d0311de
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cEAC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\cEAC.exe
        • Size 209KB
        • SHA256 878b6b6b8d128c7d4d9cb23da21ab65126fd9f87d0f97897773d7b25e489db30
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cUsw.exe

        • Path C:\Users\Admin\AppData\Local\Temp\cUsw.exe
        • Size 408KB
        • SHA256 28eebf4b0d085bf7d789243fe3d132bb8ca092d99efe050ce723a35af64a766b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cYMA.exe

        • Path C:\Users\Admin\AppData\Local\Temp\cYMA.exe
        • Size 464KB
        • SHA256 11bf0a422cc81891b3ff06a70d4a06cf7d136d142ac6770eccdab82bed53d79d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ckIC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ckIC.exe
        • Size 223KB
        • SHA256 f79f9e77a393f4a0c6b9385e84d570315d817ffe5af207c1ace2fd800af3b3c1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        eQAM.exe

        • Path C:\Users\Admin\AppData\Local\Temp\eQAM.exe
        • Size 365KB
        • SHA256 4190f21c9a47e57b324517507d09af1f3041e466b70e926da85b13a3dd7aa278
        • MD5 SHA1 SHA512 SSDEEP TLSH

        eUoO.exe

        • Path C:\Users\Admin\AppData\Local\Temp\eUoO.exe
        • Size 806KB
        • SHA256 c61820da095fbfc6b6caee07438f128dac559268bbbd3a999030df9fd869184e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ewUW.ico

        • Path C:\Users\Admin\AppData\Local\Temp\ewUW.ico
        • Size 4KB
        • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gAUA.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gAUA.exe
        • Size 186KB
        • SHA256 b5ff12fb1f1c90d7e4730e1797ceec09a8e8a4ae2908fcacbc75bf3777f4dfe0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gAwy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gAwy.exe
        • Size 991KB
        • SHA256 288a9719efa36a1e0b15d87959bd8b5171e42b8dd0d03e1d5e9a86b336d6f92f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gEcW.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gEcW.exe
        • Size 831KB
        • SHA256 f7def94a28951c5383abdb940d6208079089bdfddf544575d5c374386ffcfc09
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gIkw.ico

        • Path C:\Users\Admin\AppData\Local\Temp\gIkw.ico
        • Size 4KB
        • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gUgm.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gUgm.exe
        • Size 1.4MB
        • SHA256 a898157577ecf807626aa1cbc8ebe59d5729fad5211a85893a815fb2a104bb3d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gYcy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gYcy.exe
        • Size 225KB
        • SHA256 bef5232f5ffd3a9e36534b658711502c8f5e08c73e72d950df6bba4e68569a68
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gkEk.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gkEk.exe
        • Size 365KB
        • SHA256 b0545132cb6a77dc471e33084e255da50841e60a02db6fa592901a11ef47858b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gwEq.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gwEq.exe
        • Size 569KB
        • SHA256 29fbeb478defb42ec61edf158525b1dcfdf36c61ed8c13b1f34a7cee434b1c67
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gwIw.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gwIw.exe
        • Size 583KB
        • SHA256 d9f08a140bdcf0ad7ecba747255f60228d4acf5074894db36c4f7b1e135dbe54
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iEso.exe

        • Path C:\Users\Admin\AppData\Local\Temp\iEso.exe
        • Size 988KB
        • SHA256 1e4357c4b3bd768d812bf1f20280851886ba535f3f2cbf6ba3672f3163234c5b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ioIs.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ioIs.exe
        • Size 195KB
        • SHA256 5f41fb617aace6e63683a23de1edbd9f4753054f062cd2310ece23aad9484a89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iwMk.exe

        • Path C:\Users\Admin\AppData\Local\Temp\iwMk.exe
        • Size 297KB
        • SHA256 1cd5edbcfce4d6aa8c057aed05ddec44a622be0d9601fe0c103c902e8b8d60a6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kIIC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\kIIC.exe
        • Size 746KB
        • SHA256 5dcc481b514e5599e37e3eebad85387706e12ad5dcd76467d03b81b65d9d0501
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kkgu.exe

        • Path C:\Users\Admin\AppData\Local\Temp\kkgu.exe
        • Size 311KB
        • SHA256 eeb26b4e7ee9509f4c7bc4432bb915e082db73635d55aba5120b001353e4953b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kssC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\kssC.exe
        • Size 574KB
        • SHA256 53488212ab2dc0b4c0a8338ad3d73a6d6ed1e3cb3ab23ce9fcad1ff3e3a41467
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kwEI.exe

        • Path C:\Users\Admin\AppData\Local\Temp\kwEI.exe
        • Size 623KB
        • SHA256 a4c832de0ad20d672354313e5006d6995119f684c99f3cfadb7c5f637e38b1ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mAUm.exe

        • Path C:\Users\Admin\AppData\Local\Temp\mAUm.exe
        • Size 186KB
        • SHA256 2fb15a78b1f12ffdbbef5783a7d61633883a21bbed3b8c47f98dd11183dd87a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mIsi.exe

        • Path C:\Users\Admin\AppData\Local\Temp\mIsi.exe
        • Size 800KB
        • SHA256 a0f51e47d38c63e4165071e3d3a7943bccec1ab5d9cf1e00a9829eb654af558b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mMIG.exe

        • Path C:\Users\Admin\AppData\Local\Temp\mMIG.exe
        • Size 316KB
        • SHA256 733be3b1e200e8c67b225e5a2f5be6163553049dfc2575d5f186d45186476970
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msQI.exe

        • Path C:\Users\Admin\AppData\Local\Temp\msQI.exe
        • Size 203KB
        • SHA256 079ff2acfaed5c2d24916269c3a573f19b7e0558a9af30e6cb58ed6114089f04
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msoA.exe

        • Path C:\Users\Admin\AppData\Local\Temp\msoA.exe
        • Size 203KB
        • SHA256 b592bbe2307a6410b1a3b7266a360926427835dda967d4f34c2a718ed25fd53a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        newfix.exe

        • Path C:\Users\Admin\AppData\Local\Temp\newfix.exe
        • Size 5KB
        • SHA256 a1096d41a715b040a74fbcc98d83de55b968d966254687c340d2b1961fec50be
        • MD5 SHA1 SHA512 SSDEEP TLSH

        oIYU.exe

        • Path C:\Users\Admin\AppData\Local\Temp\oIYU.exe
        • Size 705KB
        • SHA256 abf07959035a30ba43fda1a722b810cd9d67bc4148978f1197bb5efcd01d43cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        oMUS.exe

        • Path C:\Users\Admin\AppData\Local\Temp\oMUS.exe
        • Size 446KB
        • SHA256 33253a3cd01429cfd01b4d5b8681d654319e1f4dda7c3182df4b75c112d2c57e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ocoo.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ocoo.exe
        • Size 239KB
        • SHA256 3db2d1943cbb331f7fe63455f48ae13fa733263424823dec57cc165667c117f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ogkC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ogkC.exe
        • Size 939KB
        • SHA256 758aeab49cf99c1649722298d7f0c9b56b8f277e371c12a0ee8de3c74042928e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qUoK.exe

        • Path C:\Users\Admin\AppData\Local\Temp\qUoK.exe
        • Size 216KB
        • SHA256 954523660705f126c5c210a814ab47942a2880eaf9f007d7ee36bbfe445d28af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qwYG.exe

        • Path C:\Users\Admin\AppData\Local\Temp\qwYG.exe
        • Size 820KB
        • SHA256 2b714f8e3b2858a8b431594315d40693dac0255286c8f34894280199ab112530
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sUIQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\sUIQ.exe
        • Size 560KB
        • SHA256 61baf8753ec4c52946059d8285a7ba665e7e946c349cc628ab23888022458dd0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sgAi.exe

        • Path C:\Users\Admin\AppData\Local\Temp\sgAi.exe
        • Size 202KB
        • SHA256 aab604d3d859fa75ce68638d2966a0772335f0bc35fac692dd3c8019f4ced500
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ucAA.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ucAA.exe
        • Size 621KB
        • SHA256 12b8ec702df8c2f2db52030b5eceec06d44c64fbaae62ccfa5f05483ac13e3c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ucsg.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ucsg.exe
        • Size 570KB
        • SHA256 a1e41fb6604bc373e31893d02738c1dc79a1b084d0efa7e8cebc3b47e5289efb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uoIo.exe

        • Path C:\Users\Admin\AppData\Local\Temp\uoIo.exe
        • Size 1.2MB
        • SHA256 71e4e74a7c4d4ec84fffa2b412634176e1b3dc0b5b60ec4ee267f23b319c0ad5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        usEM.exe

        • Path C:\Users\Admin\AppData\Local\Temp\usEM.exe
        • Size 821KB
        • SHA256 6f473233d2988ee09890f11915dc7ba701300100a8b8375d5299342f10c5f608
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wEwk.exe

        • Path C:\Users\Admin\AppData\Local\Temp\wEwk.exe
        • Size 349KB
        • SHA256 020e0f829feb588cf1974f7a236c6abe3776bf5870a6e9942b2815dfa838141c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wYMc.exe

        • Path C:\Users\Admin\AppData\Local\Temp\wYMc.exe
        • Size 524KB
        • SHA256 150c6337aff65a12197fbfb6b303ae08b6254be3ba860b3582abf6d97dd921b5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wYoE.exe

        • Path C:\Users\Admin\AppData\Local\Temp\wYoE.exe
        • Size 797KB
        • SHA256 43c82ff954cd91e87671da9fe1d3f2dc45c28a255b244a0cfe13b5ebe5fbf001
        • MD5 SHA1 SHA512 SSDEEP TLSH

        yEkI.exe

        • Path C:\Users\Admin\AppData\Local\Temp\yEkI.exe
        • Size 676KB
        • SHA256 30af06e7374d86aa44743b0f994d18a12a5e11861029bff9e846d9899010c55a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        yQwQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\yQwQ.exe
        • Size 407KB
        • SHA256 87a9107d202239fba03397f72c44e931d4c3630d15a2be4ce5c0921f699913ee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        yQwy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\yQwy.exe
        • Size 871KB
        • SHA256 f9691164af11a25b340ccd60c04da44721f1d97aef56426f3ae4fb824a70a13e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        yYMi.exe

        • Path C:\Users\Admin\AppData\Local\Temp\yYMi.exe
        • Size 425KB
        • SHA256 0c539848d9cc6b6ee4be773a130c3e1b0a978c727085d33980bd9e44ef390c58
        • MD5 SHA1 SHA512 SSDEEP TLSH

        yYok.exe

        • Path C:\Users\Admin\AppData\Local\Temp\yYok.exe
        • Size 203KB
        • SHA256 4b61f74169666510078ec8d89286e3310bc3830aaf02ca655ab6e42356efac8e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        yYsC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\yYsC.exe
        • Size 884KB
        • SHA256 52c30c29610d85bc2b411e4138cdc27674542538f4fa83c9876f4f7b6ec9789a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ykgm.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ykgm.exe
        • Size 471KB
        • SHA256 7afec32b879f47393046836a513a124b809495b1fe94d1e26c989bbf6899aebb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        yksy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\yksy.exe
        • Size 196KB
        • SHA256 a2a86b10ea63a89abfe3f954e36c191621e79e2d22944ec78ec837603fb5498b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        xEoUIAog.exe

        • Path C:\Users\Admin\vWEQwMkk\xEoUIAog.exe
        • Size 195KB
        • SHA256 940a6db9add30eebf4da77c7e292919dbe6e32e30b309f7edbb1b683fd6e3fcf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        xEoUIAog.inf

        • Path C:\Users\Admin\vWEQwMkk\xEoUIAog.inf
        • Size 4B
        • SHA256 af15aa87d4d15aecb0c6fe9ac33b177c92f2003b6fd31af50542b981b3e7584f
        • MD5 SHA1 SHA512

        xEoUIAog.inf

        • Path C:\Users\Admin\vWEQwMkk\xEoUIAog.inf
        • Size 4B
        • SHA256 d1c9ccd86dc61ef581f76fcececaca9bdae3dbf5178732f637f3a85390570945
        • MD5 SHA1 SHA512

        xEoUIAog.inf

        • Path C:\Users\Admin\vWEQwMkk\xEoUIAog.inf
        • Size 4B
        • SHA256 5e7a7c69793d989476fcfbdc74e3da6851a762f527fac6ef1c942a3177a5c46f
        • MD5 SHA1 SHA512

        xEoUIAog.inf

        • Path C:\Users\Admin\vWEQwMkk\xEoUIAog.inf
        • Size 4B
        • SHA256 e5fddc4486e3aa4dd3d78aa121e01e143cc26303e6c649df6beccc1114895a35
        • MD5 SHA1 SHA512

        xEoUIAog.inf

        • Path C:\Users\Admin\vWEQwMkk\xEoUIAog.inf
        • Size 4B
        • SHA256 5cd12de046d361d952b464499d3a1f8ec42938572919c963f85f3d4022261f3e
        • MD5 SHA1 SHA512

        xEoUIAog.inf

        • Path C:\Users\Admin\vWEQwMkk\xEoUIAog.inf
        • Size 4B
        • SHA256 7aad331b1d4f7f64e19b306db17c9e7d478a7e6d0144f8cffac4aed398ae96e0
        • MD5 SHA1 SHA512

        xEoUIAog.inf

        • Path C:\Users\Admin\vWEQwMkk\xEoUIAog.inf
        • Size 4B
        • SHA256 d1253f033424975c9c331e93c5d1449d7bfe7e229de8be84dac061ec497afe67
        • MD5 SHA1 SHA512

        xEoUIAog.inf

        • Path C:\Users\Admin\vWEQwMkk\xEoUIAog.inf
        • Size 4B
        • SHA256 7c6c4ed03753b89b37c281c0ec43957cdab9fea6473755265215534a5c217b55
        • MD5 SHA1 SHA512

        xEoUIAog.inf

        • Path C:\Users\Admin\vWEQwMkk\xEoUIAog.inf
        • Size 4B
        • SHA256 7511bf7842bc40324f7ca8dbba92fb0a3ce8939e54a73a9c8f2fb16becb4a73f
        • MD5 SHA1 SHA512

        xEoUIAog.inf

        • Path C:\Users\Admin\vWEQwMkk\xEoUIAog.inf
        • Size 4B
        • SHA256 f66176f796d60ee8399c0aa386bf72341d3ec7a3ae73adc3420e3213755b528a
        • MD5 SHA1 SHA512

        xEoUIAog.inf

        • Path C:\Users\Admin\vWEQwMkk\xEoUIAog.inf
        • Size 4B
        • SHA256 13e085d985300b7a4a8c7471e6cd12083593b57454dc2eb256c809209c8110ad
        • MD5 SHA1 SHA512

        xEoUIAog.inf

        • Path C:\Users\Admin\vWEQwMkk\xEoUIAog.inf
        • Size 4B
        • SHA256 82137cabec9c21ebf625db347f258530fa248f9a9722024549abecd281465898
        • MD5 SHA1 SHA512

        xEoUIAog.inf

        • Path C:\Users\Admin\vWEQwMkk\xEoUIAog.inf
        • Size 4B
        • SHA256 49be63bf92f28cb967462f83283adc607479a627a438e1d2039f34f05aa8482f
        • MD5 SHA1 SHA512

        xEoUIAog.inf

        • Path C:\Users\Admin\vWEQwMkk\xEoUIAog.inf
        • Size 4B
        • SHA256 8878c2a37f0d6341a0c65d90201c2dbd9b6a4b10b7b7151e42559a3c1ba0ff85
        • MD5 SHA1 SHA512

        xEoUIAog.inf

        • Path C:\Users\Admin\vWEQwMkk\xEoUIAog.inf
        • Size 4B
        • SHA256 fdf41c85cecb5b8bf0a4eda5e1a8f9450da565046821346c629359bf70877096
        • MD5 SHA1 SHA512

        memory/2076-1511-0x0000000000400000-0x000000000042E000-memory.dmp

        memory/2476-1516-0x0000000000400000-0x0000000000432000-memory.dmp

        memory/3696-6-0x0000000000400000-0x0000000000432000-memory.dmp

        memory/3696-1501-0x0000000000400000-0x0000000000432000-memory.dmp

        memory/3852-17-0x0000000000400000-0x000000000042E000-memory.dmp

        memory/3852-1506-0x0000000000400000-0x000000000042E000-memory.dmp

        memory/4228-20-0x0000000000400000-0x0000000000436000-memory.dmp

        memory/4228-0-0x0000000000400000-0x0000000000436000-memory.dmp