Overview

overview

10

Static

static

3

2026-09-08...ck.exe

windows10-2004-x64

10

2026-09-08...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 03:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
  • Size 1.6MB
  • Sample260910-eb5j2awfla
  • SHA256 c43a77197df60b9dc43c23fd1f1988adc6ee419d1bb8b664a6d634ecfec9f60c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 15 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 15 IoCs
    defense_evasiontrojan
  • Renames multiple (112) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 15 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 30 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 45 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4528
    • C:\Users\Admin\XSsAAMok\pYAkkUEU.exe
      "C:\Users\Admin\XSsAAMok\pYAkkUEU.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:1396
    • C:\ProgramData\Tesgggog\nEcwAkks.exe
      "C:\ProgramData\Tesgggog\nEcwAkks.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:3964
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2884
      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4988
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3776
          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:620
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2560
              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:5808
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3960
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4444
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:5924
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                        11⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:1780
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:4624
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:5564
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:3304
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:2000
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:1412
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:5284
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:2416
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                        19⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4496
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                          20⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          PID:3640
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                            21⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:1956
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                              22⤵
                                              • Executes a command shell one-liner
                                              PID:4116
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                23⤵
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1320
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2812
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                    25⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4300
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5820
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                        27⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:2472
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          PID:472
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe
                                                            C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                                                            29⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:4572
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock"
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              PID:5860
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                              30⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry key
                                                              PID:3372
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                              30⤵
                                                              • Modifies registry key
                                                              PID:4772
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                              30⤵
                                                              • UAC bypass
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry key
                                                              PID:6048
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nCcYssog.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              PID:2064
                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                31⤵
                                                                • Executes a VBScript file via the Windows Script Host.
                                                                PID:2632
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                          28⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry key
                                                          PID:4652
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                          28⤵
                                                          • Modifies registry key
                                                          PID:3108
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                          28⤵
                                                          • UAC bypass
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry key
                                                          PID:4260
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NaYcwgcU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          PID:5608
                                                          • C:\Windows\SysWOW64\cscript.exe
                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                            29⤵
                                                            • Executes a VBScript file via the Windows Script Host.
                                                            • System Location Discovery: System Language Discovery
                                                            PID:3396
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                      26⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry key
                                                      PID:3952
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                      26⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry key
                                                      PID:4176
                                                      • C:\Windows\System32\Conhost.exe
                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        27⤵
                                                          PID:6088
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                        26⤵
                                                        • UAC bypass
                                                        • Modifies registry key
                                                        PID:3804
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iSgIswIA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                        26⤵
                                                        • Executes a command shell one-liner
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1784
                                                        • C:\Windows\SysWOW64\cscript.exe
                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                          27⤵
                                                          • Executes a VBScript file via the Windows Script Host.
                                                          PID:5604
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                    24⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Modifies registry key
                                                    PID:3012
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                    24⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry key
                                                    PID:1352
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                    24⤵
                                                    • UAC bypass
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry key
                                                    PID:2292
                                                    • C:\Windows\System32\Conhost.exe
                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      25⤵
                                                        PID:5896
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QAkMsIoA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                      24⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4804
                                                      • C:\Windows\SysWOW64\cscript.exe
                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                        25⤵
                                                        • Executes a VBScript file via the Windows Script Host.
                                                        PID:3912
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                  22⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Modifies registry key
                                                  PID:4504
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                  22⤵
                                                  • Modifies registry key
                                                  PID:4560
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                  22⤵
                                                  • UAC bypass
                                                  • Modifies registry key
                                                  PID:4320
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lkUgwYwQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                  22⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1440
                                                  • C:\Windows\SysWOW64\cscript.exe
                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                    23⤵
                                                    • Executes a VBScript file via the Windows Script Host.
                                                    PID:1416
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                              20⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Modifies registry key
                                              PID:3476
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                              20⤵
                                              • Modifies registry key
                                              PID:2208
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                              20⤵
                                              • UAC bypass
                                              • Modifies registry key
                                              PID:5520
                                              • C:\Windows\System32\Conhost.exe
                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                21⤵
                                                  PID:4996
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DAAMEkMs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                                20⤵
                                                • Executes a command shell one-liner
                                                • System Location Discovery: System Language Discovery
                                                PID:2516
                                                • C:\Windows\SysWOW64\cscript.exe
                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                  21⤵
                                                  • Executes a VBScript file via the Windows Script Host.
                                                  PID:5824
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                            18⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry key
                                            PID:1056
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                            18⤵
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry key
                                            PID:5752
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                            18⤵
                                            • UAC bypass
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry key
                                            PID:4820
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dgQIwUAE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                            18⤵
                                            • Executes a command shell one-liner
                                            • System Location Discovery: System Language Discovery
                                            PID:5972
                                            • C:\Windows\System32\Conhost.exe
                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              19⤵
                                                PID:4540
                                              • C:\Windows\SysWOW64\cscript.exe
                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                19⤵
                                                • Executes a VBScript file via the Windows Script Host.
                                                • System Location Discovery: System Language Discovery
                                                PID:2288
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                          16⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry key
                                          PID:6044
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                          16⤵
                                          • Modifies registry key
                                          PID:3516
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                          16⤵
                                          • UAC bypass
                                          • Modifies registry key
                                          PID:3356
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mSQsEgoI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                          16⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:4512
                                          • C:\Windows\SysWOW64\cscript.exe
                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                            17⤵
                                            • Executes a VBScript file via the Windows Script Host.
                                            • System Location Discovery: System Language Discovery
                                            PID:1316
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                      14⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Modifies registry key
                                      PID:6088
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                      14⤵
                                      • Modifies registry key
                                      PID:2008
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                      14⤵
                                      • UAC bypass
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry key
                                      PID:4176
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cCAEwEwg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                      14⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:2096
                                      • C:\Windows\SysWOW64\cscript.exe
                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                        15⤵
                                        • Executes a VBScript file via the Windows Script Host.
                                        • System Location Discovery: System Language Discovery
                                        PID:1752
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                  12⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Modifies registry key
                                  PID:3352
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                  12⤵
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry key
                                  PID:5896
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                  12⤵
                                  • UAC bypass
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry key
                                  PID:3520
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KEcIswUE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                                  12⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:5700
                                  • C:\Windows\SysWOW64\cscript.exe
                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                    13⤵
                                    • Executes a VBScript file via the Windows Script Host.
                                    PID:1460
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                              10⤵
                              • Modifies visibility of file extensions in Explorer
                              • Modifies registry key
                              PID:2424
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                              10⤵
                              • System Location Discovery: System Language Discovery
                              • Modifies registry key
                              PID:4504
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                              10⤵
                              • UAC bypass
                              • System Location Discovery: System Language Discovery
                              • Modifies registry key
                              PID:4240
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NaAQsEIQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                              10⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:5372
                              • C:\Windows\SysWOW64\cscript.exe
                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                11⤵
                                • Executes a VBScript file via the Windows Script Host.
                                • System Location Discovery: System Language Discovery
                                PID:1320
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                          8⤵
                          • Modifies visibility of file extensions in Explorer
                          • Modifies registry key
                          PID:3824
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                          8⤵
                          • System Location Discovery: System Language Discovery
                          • Modifies registry key
                          PID:5724
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                          8⤵
                          • UAC bypass
                          • System Location Discovery: System Language Discovery
                          • Modifies registry key
                          PID:4996
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lUsAMAow.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                          8⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:5140
                          • C:\Windows\SysWOW64\cscript.exe
                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                            9⤵
                            • Executes a VBScript file via the Windows Script Host.
                            PID:4196
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                      6⤵
                      • Modifies visibility of file extensions in Explorer
                      • System Location Discovery: System Language Discovery
                      • Modifies registry key
                      PID:6048
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Modifies registry key
                      PID:4540
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                      6⤵
                      • UAC bypass
                      • Modifies registry key
                      PID:2244
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IkkUMUwg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                      6⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:3932
                      • C:\Windows\SysWOW64\cscript.exe
                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                        7⤵
                        • Executes a VBScript file via the Windows Script Host.
                        PID:1956
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                  4⤵
                  • Modifies visibility of file extensions in Explorer
                  • System Location Discovery: System Language Discovery
                  • Modifies registry key
                  PID:2316
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry key
                  PID:3108
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                  4⤵
                  • UAC bypass
                  • System Location Discovery: System Language Discovery
                  • Modifies registry key
                  PID:5080
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wukMgEMY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
                  4⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1276
                  • C:\Windows\SysWOW64\cscript.exe
                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                    5⤵
                    • Executes a VBScript file via the Windows Script Host.
                    • System Location Discovery: System Language Discovery
                    PID:1364
            • C:\Windows\SysWOW64\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
              2⤵
              • Modifies visibility of file extensions in Explorer
              • System Location Discovery: System Language Discovery
              • Modifies registry key
              PID:4280
            • C:\Windows\SysWOW64\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
              2⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry key
              PID:4872
            • C:\Windows\SysWOW64\reg.exe
              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
              2⤵
              • UAC bypass
              • System Location Discovery: System Language Discovery
              • Modifies registry key
              PID:624
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ReIoAkog.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock.exe""
              2⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4340
              • C:\Windows\SysWOW64\cscript.exe
                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                3⤵
                • Executes a VBScript file via the Windows Script Host.
                • System Location Discovery: System Language Discovery
                PID:5040
          • C:\ProgramData\WoYosUIs\poMEcAMY.exe
            C:\ProgramData\WoYosUIs\poMEcAMY.exe
            1⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            PID:1720
          • C:\Users\Admin\XSsAAMok\pYAkkUEU.exe
            C:\Users\Admin\XSsAAMok\pYAkkUEU.exe
            1⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:4432
          • C:\ProgramData\Tesgggog\nEcwAkks.exe
            C:\ProgramData\Tesgggog\nEcwAkks.exe
            1⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:2960

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                2
                T1059

                Visual Basic

                1
                T1059.005

                Windows Command Shell

                1
                T1059.003

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Privilege Escalation

                Abuse Elevation Control Mechanism

                1
                T1548

                Bypass User Account Control

                1
                T1548.002

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Defense Evasion

                Abuse Elevation Control Mechanism

                1
                T1548

                Bypass User Account Control

                1
                T1548.002

                Hide Artifacts

                1
                T1564

                Hidden Files and Directories

                1
                T1564.001

                Impair Defenses

                1
                T1562

                Disable or Modify Tools

                1
                T1562.001

                Modify Registry

                4
                T1112

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                System Information Discovery

                1
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                nEcwAkks.exe
                • Path C:\ProgramData\Tesgggog\nEcwAkks.exe
                • Size 1.6MB
                • SHA256 df5686513173841b2335a658a7f753a4d53700776788495cc4c94d45cd66b28f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nEcwAkks.inf
                • Path C:\ProgramData\Tesgggog\nEcwAkks.inf
                • Size 4B
                • SHA256 69a4ec8ebdc82fdbeeffce010ab841082f216f25ba7b4f9caf9dedec0fd39168
                • MD5 SHA1 SHA512
                Submit Download

                nEcwAkks.inf
                • Path C:\ProgramData\Tesgggog\nEcwAkks.inf
                • Size 4B
                • SHA256 a11e9c06182e9206fd162e556856de5121d0008f6d59a58312a4ec79cd23caee
                • MD5 SHA1 SHA512
                Submit Download

                nEcwAkks.inf
                • Path C:\ProgramData\Tesgggog\nEcwAkks.inf
                • Size 4B
                • SHA256 5a7dd008d0505c261dff562bb6e5a1390ebf87180e3d547e1a70fad2b835abf5
                • MD5 SHA1 SHA512
                Submit Download

                nEcwAkks.inf
                • Path C:\ProgramData\Tesgggog\nEcwAkks.inf
                • Size 4B
                • SHA256 fc62b540ea570fef779d19054d54b8b8e001ff918d2498bc54d50ff585862566
                • MD5 SHA1 SHA512
                Submit Download

                poMEcAMY.exe
                • Path C:\ProgramData\WoYosUIs\poMEcAMY.exe
                • Size 1.6MB
                • SHA256 64dca9d2155d33d0aee02c3f4d9aad50b06d64191d4ab6f5bf1b25056a0cae86
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                YOUs.txt
                • Path C:\ProgramData\YOUs.txt
                • Size 9KB
                • SHA256 cdba811bb5ef7f92177cccf22e3f2ce57adc052d1371d7eb49a60c20815e0964
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_a042a1311dbb8cc42d630d9ece299b9f_elex_virlock
                • Size 4KB
                • SHA256 60348204224cc739cf0b4aef935b3d8b774ca91f4609e61ca04a290d3531c768
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AAwG.exe
                • Path C:\Users\Admin\AppData\Local\Temp\AAwG.exe
                • Size 2.1MB
                • SHA256 30f87e94292862d178e427218e425427c5880cf8ae0ec3dca752efa45b75a8be
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AEkg.exe
                • Path C:\Users\Admin\AppData\Local\Temp\AEkg.exe
                • Size 1.7MB
                • SHA256 9b8ee33984f38e954c09fda41d4a44a53b7a5ff7b0a7ed61c5e2c0b0f5630464
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AcAS.exe
                • Path C:\Users\Admin\AppData\Local\Temp\AcAS.exe
                • Size 1.8MB
                • SHA256 201d30a70869f8c0c16aded6be5475df13774ce93e4e65063a90523bf6d2ac34
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AcsU.exe
                • Path C:\Users\Admin\AppData\Local\Temp\AcsU.exe
                • Size 1.9MB
                • SHA256 65afffc7f021a1a9897f996c33dc07dcf2669f59fd890ac2c9955893107af126
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AsIG.exe
                • Path C:\Users\Admin\AppData\Local\Temp\AsIG.exe
                • Size 1.6MB
                • SHA256 b32755428b000e774cb41c5f3a1e4af64f6beb0269e0b7b7550f457d3fae9472
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Asca.exe
                • Path C:\Users\Admin\AppData\Local\Temp\Asca.exe
                • Size 1.6MB
                • SHA256 0c9c8a0c9f7eb4c9ceadb5f6a131d77727a207f99703a437c9e36c6e9f590f07
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                CEoQ.exe
                • Path C:\Users\Admin\AppData\Local\Temp\CEoQ.exe
                • Size 1.6MB
                • SHA256 ab8fc5a3574f91b9e56f1d69cfd91e2b33ba0db7b83e459980a9240750831dfa
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                CIEK.exe
                • Path C:\Users\Admin\AppData\Local\Temp\CIEK.exe
                • Size 3.8MB
                • SHA256 f8f5aa0a1ba6279f79bea706d50c0b5c701fb3bc6fd36956445db2c3fa20be2e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                CMYs.exe
                • Path C:\Users\Admin\AppData\Local\Temp\CMYs.exe
                • Size 1.6MB
                • SHA256 3b4f7fd959e8f5e4319acc165b15258cd9391303edf58fcec78855eb669fb15b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                CQok.exe
                • Path C:\Users\Admin\AppData\Local\Temp\CQok.exe
                • Size 1.9MB
                • SHA256 722f3dda1c45001400bf282a7b1323815bbbce80bd56572c867ead4ed430e10c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                CUMS.exe
                • Path C:\Users\Admin\AppData\Local\Temp\CUMS.exe
                • Size 1.9MB
                • SHA256 92bd55dd7001f5dd754f6d39dfc1662bf2c8ba069a10ee7015249e372019a877
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                CkQg.exe
                • Path C:\Users\Admin\AppData\Local\Temp\CkQg.exe
                • Size 2.0MB
                • SHA256 e8444ad45d4769dcd9d4f8275dec52735b378a8bafc195536f999e7e2ad08966
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                CkwC.exe
                • Path C:\Users\Admin\AppData\Local\Temp\CkwC.exe
                • Size 1.7MB
                • SHA256 14556d28abe99c7be8e91c67d490e2a32c2662304190a79f1f558762f8f2a573
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                CowW.exe
                • Path C:\Users\Admin\AppData\Local\Temp\CowW.exe
                • Size 1.8MB
                • SHA256 85b704a424f372016b0b3dd2c1f546a8fcda1b77a3c2ee72c0f3322f0be90f26
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                EAoc.exe
                • Path C:\Users\Admin\AppData\Local\Temp\EAoc.exe
                • Size 2.2MB
                • SHA256 0ddebe638b31e746b346ce41ffea92129d6f2edab8c057e22deb644c325d6d8c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                EYcq.exe
                • Path C:\Users\Admin\AppData\Local\Temp\EYcq.exe
                • Size 1.8MB
                • SHA256 17649276aefeacf805e8e3a33cb87516c721d58183d5a1d62cef64c6b15e6f6c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                EgoE.ico
                • Path C:\Users\Admin\AppData\Local\Temp\EgoE.ico
                • Size 4KB
                • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Eqcw.ico
                • Path C:\Users\Admin\AppData\Local\Temp\Eqcw.ico
                • Size 4KB
                • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                EsEY.ico
                • Path C:\Users\Admin\AppData\Local\Temp\EsEY.ico
                • Size 4KB
                • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                EsUq.exe
                • Path C:\Users\Admin\AppData\Local\Temp\EsUq.exe
                • Size 1.6MB
                • SHA256 117ba9e7042c4b383623ee42c5e18245f02faceff89c252d4c05bf0b89afdc03
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                GIwM.exe
                • Path C:\Users\Admin\AppData\Local\Temp\GIwM.exe
                • Size 1.9MB
                • SHA256 e8375310c69482e589b5e5601e81ceaa6a17501eeada176cb64f739152c2c80a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                GMQe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\GMQe.exe
                • Size 1.6MB
                • SHA256 625c2bf9e4e01564e39b9099c0d68a3aa86ef4951075b687f2d539c8ba85b0a8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                GMwE.exe
                • Path C:\Users\Admin\AppData\Local\Temp\GMwE.exe
                • Size 2.6MB
                • SHA256 bb1fa5d3732eef600e35a82a69ad62d4ed08c8290a6e5826eee091d86f890f26
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                GYcs.exe
                • Path C:\Users\Admin\AppData\Local\Temp\GYcs.exe
                • Size 2.9MB
                • SHA256 780fd72d50d8c3f7a8d70b54529300baf87c8eaf1b2d94b86ae1ad0c4ffe4d2e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                GkwG.exe
                • Path C:\Users\Admin\AppData\Local\Temp\GkwG.exe
                • Size 2.2MB
                • SHA256 2d961cb9b186a2b3252a405d3af91693c30740e0c02074c2bad5e15725b103ee
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Gski.exe
                • Path C:\Users\Admin\AppData\Local\Temp\Gski.exe
                • Size 1.9MB
                • SHA256 f48e507b2ee118620e213a120945a2f2c1c0dc7853c97e59d6638cfd0e824e53
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                IYoo.exe
                • Path C:\Users\Admin\AppData\Local\Temp\IYoo.exe
                • Size 1.6MB
                • SHA256 6038d08f583a7140c57936113730dec953a1d5ae03016e44c019679ca37773b8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                IgUc.exe
                • Path C:\Users\Admin\AppData\Local\Temp\IgUc.exe
                • Size 1.9MB
                • SHA256 cf40839b2c919c3605130268d5041400ae6b73455dee3f33d0ac5d32f815ca78
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Ikoq.exe
                • Path C:\Users\Admin\AppData\Local\Temp\Ikoq.exe
                • Size 1.6MB
                • SHA256 c5fefc94f965d23d417fc42b9f06b48c0149e1eae688cea7f85a0e6371062857
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                KCAs.ico
                • Path C:\Users\Admin\AppData\Local\Temp\KCAs.ico
                • Size 4KB
                • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                KEEM.exe
                • Path C:\Users\Admin\AppData\Local\Temp\KEEM.exe
                • Size 1.6MB
                • SHA256 8504906efa8b6eb42bbeb98a9ace547ba0791b7168a0bf4d979e40f481f469bf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                KGEE.ico
                • Path C:\Users\Admin\AppData\Local\Temp\KGEE.ico
                • Size 4KB
                • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                KIsU.exe
                • Path C:\Users\Admin\AppData\Local\Temp\KIsU.exe
                • Size 1.9MB
                • SHA256 a25946d1555af7cf80be32686421c6b26e98b441ab2768cc52685b8d17e9aabd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                KMQq.exe
                • Path C:\Users\Admin\AppData\Local\Temp\KMQq.exe
                • Size 2.1MB
                • SHA256 2b7d7552c86e317873059296f7203cccd7ef611b5a91e02b98a4d59c472af33e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                KQwA.exe
                • Path C:\Users\Admin\AppData\Local\Temp\KQwA.exe
                • Size 1.6MB
                • SHA256 0b8f8ad191845a4536d4507f60f0ce1614206c5b079750db8a585ad111e1e652
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                KUAc.exe
                • Path C:\Users\Admin\AppData\Local\Temp\KUAc.exe
                • Size 2.2MB
                • SHA256 a183cd76c05d6e566b5961d6ed2eb40010fe3a4768892e0f37dfaa3669c34d0f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                KUQq.exe
                • Path C:\Users\Admin\AppData\Local\Temp\KUQq.exe
                • Size 1.8MB
                • SHA256 61f07dcfd88ebf8cdadee4d08c2e33131e2734376e10b4b4f8304e4f81c0ade3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                KUwA.ico
                • Path C:\Users\Admin\AppData\Local\Temp\KUwA.ico
                • Size 4KB
                • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                KoEK.exe
                • Path C:\Users\Admin\AppData\Local\Temp\KoEK.exe
                • Size 2.1MB
                • SHA256 e3dc1e9f91177e2e46de9f0e07d95b5cb6ed905724309c12d225421628b3fd5d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MEMg.exe
                • Path C:\Users\Admin\AppData\Local\Temp\MEMg.exe
                • Size 1.6MB
                • SHA256 f62c94cc73e559c942091b3f92388a73a3845f8558716c9d1ba555a653f5216a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MUMG.exe
                • Path C:\Users\Admin\AppData\Local\Temp\MUMG.exe
                • Size 2.0MB
                • SHA256 7e6c958b3cfdebb4ff65ea747159d68cec43356200b84dfb156dabf8c2314e6d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MYMs.exe
                • Path C:\Users\Admin\AppData\Local\Temp\MYMs.exe
                • Size 2.5MB
                • SHA256 e6d7c67967e877eb6d695b9e3757e0582109074164cbaf1a27c799a601d18fd0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MgQS.exe
                • Path C:\Users\Admin\AppData\Local\Temp\MgQS.exe
                • Size 1.7MB
                • SHA256 c1ec5441d3bbaba6988d71da53040f45e3eafe94855c904c8d51efc9b81230d8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MoIm.exe
                • Path C:\Users\Admin\AppData\Local\Temp\MoIm.exe
                • Size 2.1MB
                • SHA256 5f43d46756f08bd05f0446af48707cf55a1d79693641575edffa5e1776fe5693
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OUos.exe
                • Path C:\Users\Admin\AppData\Local\Temp\OUos.exe
                • Size 1.7MB
                • SHA256 91e357ff2680debb935c029ee456869070b56ccf9e17ead69063ca54e68d7943
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Ogka.exe
                • Path C:\Users\Admin\AppData\Local\Temp\Ogka.exe
                • Size 1.6MB
                • SHA256 8fd31589c69123365a0126fbb43d10ebce1acf210514fe9885c45ae78befbcb3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OoIi.exe
                • Path C:\Users\Admin\AppData\Local\Temp\OoIi.exe
                • Size 1.9MB
                • SHA256 6aea76f7eb7bd0c44c243d2fac47cc4764daf4243354ee8cc1afdd7e1e8f4d4c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Osog.exe
                • Path C:\Users\Admin\AppData\Local\Temp\Osog.exe
                • Size 2.0MB
                • SHA256 012bd903948f1b38ad7f8ed056855742a8a7ff9eda135c5d34b7077d937a24f1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OwUe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\OwUe.exe
                • Size 1.9MB
                • SHA256 6b7911cb40a76bf472fa2865bb06cf2aa250556688f1a081d0724f48355b347b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OwgU.exe
                • Path C:\Users\Admin\AppData\Local\Temp\OwgU.exe
                • Size 1.9MB
                • SHA256 0ca93d00dd1b5c403655ff77a4c8b90953ccad6ffc53be4c5baa573da6f75c5d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                QKAI.ico
                • Path C:\Users\Admin\AppData\Local\Temp\QKAI.ico
                • Size 4KB
                • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                QksC.exe
                • Path C:\Users\Admin\AppData\Local\Temp\QksC.exe
                • Size 2.2MB
                • SHA256 32a5eda1d01a19c5f50942ea217ec70799882c43bb45a7120edf95967ad6a975
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                QoAS.exe
                • Path C:\Users\Admin\AppData\Local\Temp\QoAS.exe
                • Size 1.6MB
                • SHA256 76bd03f57c02974566f6ddaea0eab1f1f0c7cdd2b8b78a0e9ceffa3b077d871a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SEAs.exe
                • Path C:\Users\Admin\AppData\Local\Temp\SEAs.exe
                • Size 2.3MB
                • SHA256 12d9c01073bb7f55f934a1960c028144a6e61b023df1893a08f7ecd8ba7a3489
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SkMO.exe
                • Path C:\Users\Admin\AppData\Local\Temp\SkMO.exe
                • Size 1.6MB
                • SHA256 a75c86a2056c930be947a64fc774b6f494f42c6889078987801b1e05bd250915
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SoAO.exe
                • Path C:\Users\Admin\AppData\Local\Temp\SoAO.exe
                • Size 1.9MB
                • SHA256 e8418adf7132e4a5f3028de25b7580eaca99f46ebed3582748d10741d6c932da
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SocI.exe
                • Path C:\Users\Admin\AppData\Local\Temp\SocI.exe
                • Size 1.6MB
                • SHA256 062f269fef88f5d09359f5fb46fb4151535caa71413222384a7a93915a810eb0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Socm.exe
                • Path C:\Users\Admin\AppData\Local\Temp\Socm.exe
                • Size 1.7MB
                • SHA256 6c1a1337e79830dffac400cde5b85cc7145b85e391fba820dfe1716f383e1d4c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SsUW.exe
                • Path C:\Users\Admin\AppData\Local\Temp\SsUW.exe
                • Size 1.8MB
                • SHA256 883ec5e5842f1d165ca4e90aff7e76275856fadb207d1d5e4fb5c8c8804a4ba3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                UEUc.exe
                • Path C:\Users\Admin\AppData\Local\Temp\UEUc.exe
                • Size 1.6MB
                • SHA256 0c3e9cab56e81e5cea08cf5a7654594f03eeb2031fd09cdc1932f2dcba351344
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Ugwa.exe
                • Path C:\Users\Admin\AppData\Local\Temp\Ugwa.exe
                • Size 1.6MB
                • SHA256 0dc88dc1a82ecfaceafa052998c31a2da6783bce48606a839754b05376861c82
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WIkk.exe
                • Path C:\Users\Admin\AppData\Local\Temp\WIkk.exe
                • Size 1.6MB
                • SHA256 b10da5cf9588e499de0177f48ceb8deab3518d780f0ceef9a5649034fffd41c0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WUkI.ico
                • Path C:\Users\Admin\AppData\Local\Temp\WUkI.ico
                • Size 4KB
                • SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Wcoo.exe
                • Path C:\Users\Admin\AppData\Local\Temp\Wcoo.exe
                • Size 1.8MB
                • SHA256 c35557888be720458f44c76ba384a6f0610a930afcd1de168adddc69652c4aa6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WsAq.exe
                • Path C:\Users\Admin\AppData\Local\Temp\WsAq.exe
                • Size 1.6MB
                • SHA256 8858215ee6362bf79807678fd8f58d498eb6adb841008b3be802716a026f9709
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WwEk.exe
                • Path C:\Users\Admin\AppData\Local\Temp\WwEk.exe
                • Size 1.8MB
                • SHA256 324025b1870d4695c3ace050059baf11689fa560d5365aeb1cadcc2d18985c70
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                YEEc.exe
                • Path C:\Users\Admin\AppData\Local\Temp\YEEc.exe
                • Size 2.2MB
                • SHA256 a44e88031ea0e45d8a10b0af8a765bdc4cda29d24031b6295da39a5ef2166c69
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                YGYM.ico
                • Path C:\Users\Admin\AppData\Local\Temp\YGYM.ico
                • Size 4KB
                • SHA256 114dae4c54ca426f78e50998727dac92942261d71ca5b2dbaf413794dcf8ad82
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                YIIK.exe
                • Path C:\Users\Admin\AppData\Local\Temp\YIIK.exe
                • Size 2.9MB
                • SHA256 473bf767052512c4384dcf8ec3b6cef0702fc0eaadd1007e37e87a12c29b4cc8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                YMMM.exe
                • Path C:\Users\Admin\AppData\Local\Temp\YMMM.exe
                • Size 2.2MB
                • SHA256 dcc97003c2de64f9924e04df31418cb9b24a0c81064cc409aaf5c028a03e1558
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                YYwA.exe
                • Path C:\Users\Admin\AppData\Local\Temp\YYwA.exe
                • Size 1.9MB
                • SHA256 f0cf391aeeb1a64d43bc6ac57f0cb071ce3d429cc63b94ceaf44b15f3460ac03
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                YcIA.exe
                • Path C:\Users\Admin\AppData\Local\Temp\YcIA.exe
                • Size 1.6MB
                • SHA256 1ea3ed2d68b7d87748581ce2a31ec7e659accf7b32fc6c682a571d698724523f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                YcgM.exe
                • Path C:\Users\Admin\AppData\Local\Temp\YcgM.exe
                • Size 2.0MB
                • SHA256 81f9774b171f55448a8a565ab8abb532193d085457b35f20abec9523ca3bd277
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                YcgW.exe
                • Path C:\Users\Admin\AppData\Local\Temp\YcgW.exe
                • Size 2.3MB
                • SHA256 241a1eede1e5069cd117df14ac282622dfc78a7b767bc84e222075b0c345c77f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Yckc.exe
                • Path C:\Users\Admin\AppData\Local\Temp\Yckc.exe
                • Size 1.6MB
                • SHA256 1abb2987687719d902a02dffbfa6ea3f9d00073e5aa3e35ea4d1aa26ae2083dc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                aAYg.exe
                • Path C:\Users\Admin\AppData\Local\Temp\aAYg.exe
                • Size 2.0MB
                • SHA256 5b23534a500cabac412f0a97ad9baa058101ab1e71c7e1160be1e33e6c7290c2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                aQUi.exe
                • Path C:\Users\Admin\AppData\Local\Temp\aQUi.exe
                • Size 1.7MB
                • SHA256 3f5fa25c62410ebab64e799361cfe757dcb4234f628762abd9c195c3b8f7c6d5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                aQYU.exe
                • Path C:\Users\Admin\AppData\Local\Temp\aQYU.exe
                • Size 1.6MB
                • SHA256 d968fe732114dd26d00c99715857a1df957becebd5a74bdb846b8dc25668c6ea
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                aWUA.ico
                • Path C:\Users\Admin\AppData\Local\Temp\aWUA.ico
                • Size 4KB
                • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                acUU.exe
                • Path C:\Users\Admin\AppData\Local\Temp\acUU.exe
                • Size 1.9MB
                • SHA256 6112fc219bbbdefe562956797615f7cbc2ca82610d534371def49acb6bd22537
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                akUU.exe
                • Path C:\Users\Admin\AppData\Local\Temp\akUU.exe
                • Size 1.7MB
                • SHA256 e72cb1fca07334955908d035cca908031b49d6c30ea33e3c44415b8e60b979ee
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cAAQ.exe
                • Path C:\Users\Admin\AppData\Local\Temp\cAAQ.exe
                • Size 1.9MB
                • SHA256 8cde911b0bae28d3c20157fea5f9f70dc03f8e49d3c8379b22bc430f7b781739
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cAQe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\cAQe.exe
                • Size 2.2MB
                • SHA256 b0a963ad9274f9d7b85afc9ea20f44b98f8dfac18a36c1a6bd5f28aa00d017d2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cUoU.exe
                • Path C:\Users\Admin\AppData\Local\Temp\cUoU.exe
                • Size 2.2MB
                • SHA256 bef964982d9ef2c8b64b095fd3ea5dfc41658a29b16961a1e11b9bffb8aecdd1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cqMk.ico
                • Path C:\Users\Admin\AppData\Local\Temp\cqMk.ico
                • Size 4KB
                • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                eIks.exe
                • Path C:\Users\Admin\AppData\Local\Temp\eIks.exe
                • Size 1.6MB
                • SHA256 620dedf6779c0029fba16d56d0cfa4831ad801be26c2b84db7e5020b7984ea53
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                eMIK.exe
                • Path C:\Users\Admin\AppData\Local\Temp\eMIK.exe
                • Size 3.1MB
                • SHA256 d7705603cf08bec70b43cdedb5a4d98cd4926e5e75cc65e952cbce2691e5b02d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                eMwC.exe
                • Path C:\Users\Admin\AppData\Local\Temp\eMwC.exe
                • Size 2.2MB
                • SHA256 eab731ca9a3cce40f527c0873049dff8a92d3e446aa0b9c310f1d7190297aec0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                eYYu.exe
                • Path C:\Users\Admin\AppData\Local\Temp\eYYu.exe
                • Size 2.3MB
                • SHA256 0d7de650982a11c6bdccd5e1060347bc8af82fd8fa1b3515d40a808e99c58e22
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ecEm.exe
                • Path C:\Users\Admin\AppData\Local\Temp\ecEm.exe
                • Size 2.1MB
                • SHA256 0e244e43184a7be3000d2d8290c8b71a9818cf0152e1ab49b6c0de5037e83764
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ecgS.exe
                • Path C:\Users\Admin\AppData\Local\Temp\ecgS.exe
                • Size 1.7MB
                • SHA256 999d8941b3025693fa516bb132a6265891d20bf5c96bd21647253081f0fccc29
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                egAC.exe
                • Path C:\Users\Admin\AppData\Local\Temp\egAC.exe
                • Size 1.7MB
                • SHA256 296da2dfb7acab12eb59befaa8db546646b21e23ed187373f723c26b8b72ba20
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ekUm.exe
                • Path C:\Users\Admin\AppData\Local\Temp\ekUm.exe
                • Size 1.8MB
                • SHA256 83d3a4097fa985a641f30c3b62994cf696e767465f7974baed8446948770d52e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                esgC.exe
                • Path C:\Users\Admin\AppData\Local\Temp\esgC.exe
                • Size 1.6MB
                • SHA256 033ea4dcdd6ce7cbc3d7b0a52a42f6b45e2814d618794fe3b6fd81e13ca44f1f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                file.vbs
                • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                • Size 19B
                • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                • MD5 SHA1 SHA512
                Submit Download

                gAkS.exe
                • Path C:\Users\Admin\AppData\Local\Temp\gAkS.exe
                • Size 2.0MB
                • SHA256 daa6108c3bfe80c6627626c5cc67a234f4bc886603a24ce45d6ae311352cc05c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                gIUa.exe
                • Path C:\Users\Admin\AppData\Local\Temp\gIUa.exe
                • Size 1.6MB
                • SHA256 0d3ef89abe4eb6ba3e348dccfe708ed569fb3225772a35b73dcaa0c5671a974c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                gMkQ.exe
                • Path C:\Users\Admin\AppData\Local\Temp\gMkQ.exe
                • Size 2.0MB
                • SHA256 fc1718ed99236f8149054d7f6de991c788860736c07a387648779ae746ce484b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                gcwU.exe
                • Path C:\Users\Admin\AppData\Local\Temp\gcwU.exe
                • Size 1.6MB
                • SHA256 8f3487057d02aed69c56435adfeab8545c13d2a4cdeadae10192723e96da07e7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ggMG.exe
                • Path C:\Users\Admin\AppData\Local\Temp\ggMG.exe
                • Size 1.6MB
                • SHA256 a6ac889c08731cc0bfaad036ed4440ce881720a3dcec919ba746082193fc4d6a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                icQq.exe
                • Path C:\Users\Admin\AppData\Local\Temp\icQq.exe
                • Size 1.9MB
                • SHA256 ed607292a62ac62603fe9697f872295b5956ab26330137332c11fc3548478ebc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                igQm.exe
                • Path C:\Users\Admin\AppData\Local\Temp\igQm.exe
                • Size 2.9MB
                • SHA256 513725e3fdaf43e7470ce25c3a589923deb3fa81a4dc7dc234dba2327e154c6c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ioAW.exe
                • Path C:\Users\Admin\AppData\Local\Temp\ioAW.exe
                • Size 1.6MB
                • SHA256 3eb538878c9eeb8875c78a74d929bb11a47daa496b84bfadf81ea4652d1baeed
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                isom.exe
                • Path C:\Users\Admin\AppData\Local\Temp\isom.exe
                • Size 1.8MB
                • SHA256 a6d6fb660ad8a04c21265b146e62ed68718212341b4f000bcedbcbe54d5a665d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                kkce.exe
                • Path C:\Users\Admin\AppData\Local\Temp\kkce.exe
                • Size 1.6MB
                • SHA256 33c5542a603ae68caec4b2b219f32f956f70a4a6f5984ef07c6d7ff51e6ee1db
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                kkgE.exe
                • Path C:\Users\Admin\AppData\Local\Temp\kkgE.exe
                • Size 1.6MB
                • SHA256 c19201d67f906345ba9188f9a470610dcecdca4512ef223b8d91a98c126e2149
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ksMs.exe
                • Path C:\Users\Admin\AppData\Local\Temp\ksMs.exe
                • Size 2.3MB
                • SHA256 eabe2442a9dcfe3c508d293f405492c0067d68350e3af2bb088b40dc455391a2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                kwEs.exe
                • Path C:\Users\Admin\AppData\Local\Temp\kwEs.exe
                • Size 1.7MB
                • SHA256 d3d0204c3e7cb2fe6f1f4d7b9b0b246cb92b49c11e79849a22d121bc81656159
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                mAwK.exe
                • Path C:\Users\Admin\AppData\Local\Temp\mAwK.exe
                • Size 2.2MB
                • SHA256 3a856d657735e3418a374ddefd385695c494f97188eee33704a064645702c406
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                mEUs.exe
                • Path C:\Users\Admin\AppData\Local\Temp\mEUs.exe
                • Size 1.6MB
                • SHA256 12cf985e7b7e349b5b74e86bc71b8c4c3291817e34dab4bdd0b1062fc9d79fed
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                mMkO.exe
                • Path C:\Users\Admin\AppData\Local\Temp\mMkO.exe
                • Size 1.6MB
                • SHA256 b9bafcf0f61960c64ad33125aa45b9ed386c4eaf74530191913f324d900570c2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                mwMU.exe
                • Path C:\Users\Admin\AppData\Local\Temp\mwMU.exe
                • Size 2.3MB
                • SHA256 bf5749b670185f92712d3d957918289703a1a100cef04fab2829ed8a2407d8a1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                oIMG.exe
                • Path C:\Users\Admin\AppData\Local\Temp\oIMG.exe
                • Size 2.9MB
                • SHA256 3c12cbbc137f71febb56823a426a1ea29b73ea76958c0863659cbac0de74c0a2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                oUoO.exe
                • Path C:\Users\Admin\AppData\Local\Temp\oUoO.exe
                • Size 1.6MB
                • SHA256 aee7aafeeba81755e071bf4070c201fb6ce040945121c7e1eb8af8cb3d9af285
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ogAk.exe
                • Path C:\Users\Admin\AppData\Local\Temp\ogAk.exe
                • Size 2.2MB
                • SHA256 2e16837876ff964d11e466bc16615092b7c4b68d273b9b24da7e920da5db26cf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qAsY.exe
                • Path C:\Users\Admin\AppData\Local\Temp\qAsY.exe
                • Size 1.8MB
                • SHA256 c0eb8073b1024201fdbb31fa03e220c3e73e9fb5e759ae4056840624873d5ebd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qUss.exe
                • Path C:\Users\Admin\AppData\Local\Temp\qUss.exe
                • Size 2.3MB
                • SHA256 e5bf535e0d45789f811e993fccd678dbccef06861dbfeb9bc10968d0daf27ba5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qYQc.exe
                • Path C:\Users\Admin\AppData\Local\Temp\qYQc.exe
                • Size 2.0MB
                • SHA256 1523755f5332d162d528db65fae8d10993d3c93447a35afdcc5ba987da180688
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qkEW.exe
                • Path C:\Users\Admin\AppData\Local\Temp\qkEW.exe
                • Size 2.8MB
                • SHA256 c927fc40b9f28480c3a704e386d3d13d43087c2faa40845addb2f3c824c058ef
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qoky.exe
                • Path C:\Users\Admin\AppData\Local\Temp\qoky.exe
                • Size 1.9MB
                • SHA256 bb3382d2aab00c11bef4be52e60abaa5bf7340095cdcbe792341d3179ef03459
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qsEC.exe
                • Path C:\Users\Admin\AppData\Local\Temp\qsEC.exe
                • Size 2.3MB
                • SHA256 69fa9cb215eed9d91e673654607e4ad44ee767bcace4d21980ffa33492a45dbc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                sIEA.exe
                • Path C:\Users\Admin\AppData\Local\Temp\sIEA.exe
                • Size 1.8MB
                • SHA256 38d29e52b342248174e5e59e8f367c84b751b63b8763e5fbedd95492f91dc31e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                sIUU.ico
                • Path C:\Users\Admin\AppData\Local\Temp\sIUU.ico
                • Size 4KB
                • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                sMoS.exe
                • Path C:\Users\Admin\AppData\Local\Temp\sMoS.exe
                • Size 2.0MB
                • SHA256 3400eb02b14a92af8654fb1efe2f01ead3d46872c3ba3faac8892e71ee0f1bdf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                sUIc.exe
                • Path C:\Users\Admin\AppData\Local\Temp\sUIc.exe
                • Size 2.2MB
                • SHA256 b70d71d4571a18a79c5a056b3b487bd15aea890780fa2c6417408777afaae04c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                skoq.exe
                • Path C:\Users\Admin\AppData\Local\Temp\skoq.exe
                • Size 1.6MB
                • SHA256 2bacbe0d76aa2d0b8134e88f3882787a385d4582630dc3f4bc8717ce6e784b7f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                uEQa.exe
                • Path C:\Users\Admin\AppData\Local\Temp\uEQa.exe
                • Size 1.6MB
                • SHA256 dc0d0b946c9d978fc91c4da533b7f00a073823aeaa75ce117bdfe6b2d901e8db
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ugsS.exe
                • Path C:\Users\Admin\AppData\Local\Temp\ugsS.exe
                • Size 2.1MB
                • SHA256 c78698c5380aa309dfb3874e44e34a5c220272626c662eea5bce7624fb95ced4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ukYm.exe
                • Path C:\Users\Admin\AppData\Local\Temp\ukYm.exe
                • Size 1.6MB
                • SHA256 44124dde6a25db9a26ac715eb3f16b7cc77db6541f5dd8b21ec6a7403e9721c6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                uosA.exe
                • Path C:\Users\Admin\AppData\Local\Temp\uosA.exe
                • Size 1.6MB
                • SHA256 36f8904dacef7214ff690ea1f9d36abd950015049dfd374a7ff1986ba7840037
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wAMc.exe
                • Path C:\Users\Admin\AppData\Local\Temp\wAMc.exe
                • Size 2.1MB
                • SHA256 bc9d6ae211fc17ddc7cea7d6555cc71a0fa62a57055546614fbef6d5e142f9df
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wIsK.exe
                • Path C:\Users\Admin\AppData\Local\Temp\wIsK.exe
                • Size 1.6MB
                • SHA256 1e42bb84b0453d1a46025afa00a3abe43f7fc755032e14e0e485144f8deabf7f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wQso.exe
                • Path C:\Users\Admin\AppData\Local\Temp\wQso.exe
                • Size 2.0MB
                • SHA256 9cc8fd696c09ff0b4c72b5ddfb0bd9e004d64d0ec63b948959806bb891efb321
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wYYg.ico
                • Path C:\Users\Admin\AppData\Local\Temp\wYYg.ico
                • Size 4KB
                • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wYww.exe
                • Path C:\Users\Admin\AppData\Local\Temp\wYww.exe
                • Size 2.0MB
                • SHA256 3071323edc0eb1cb78593164be4ed71f7a5bdfb4cbe5f3305e1e6af96ed6bc56
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wukMgEMY.bat
                • Path C:\Users\Admin\AppData\Local\Temp\wukMgEMY.bat
                • Size 112B
                • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                yEgs.exe
                • Path C:\Users\Admin\AppData\Local\Temp\yEgs.exe
                • Size 1.6MB
                • SHA256 d51ab4b0f2ddcd4844605b8d830b8be2a221ae5b90ca46ad25d165242bab2aba
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                yQAE.exe
                • Path C:\Users\Admin\AppData\Local\Temp\yQAE.exe
                • Size 1.6MB
                • SHA256 ea1fb4fc555defb073fcc4622da053fcef98173e50c08939112211f45effa272
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                yQwQ.exe
                • Path C:\Users\Admin\AppData\Local\Temp\yQwQ.exe
                • Size 2.2MB
                • SHA256 8c2c28b8f45e849f4c171c7251274012c0385fa314ab3cb6dec6b4e830af7ed9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                yUcM.exe
                • Path C:\Users\Admin\AppData\Local\Temp\yUcM.exe
                • Size 2.4MB
                • SHA256 4e343afca7fdebe10a07b4da3bd4dfcacedf3e306f0a10ac0c98420f4e28b115
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                yYQw.exe
                • Path C:\Users\Admin\AppData\Local\Temp\yYQw.exe
                • Size 1.8MB
                • SHA256 a684981b6297cde5b017a4e14842169ec2085a642a1d013eb5fc1290d28a69eb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                yYYU.exe
                • Path C:\Users\Admin\AppData\Local\Temp\yYYU.exe
                • Size 1.6MB
                • SHA256 86a39ebbc677896a8c65e5cec23f8613e66a1c328a113995feb6a6f812816696
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ycQY.exe
                • Path C:\Users\Admin\AppData\Local\Temp\ycQY.exe
                • Size 1.9MB
                • SHA256 60ec1cbed4f6a98f54826728240b6d03eeedc4ad15e518b367d3c9eb6ca565e2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ygsy.exe
                • Path C:\Users\Admin\AppData\Local\Temp\ygsy.exe
                • Size 1.6MB
                • SHA256 049b2548e278ee7d0d57a81ea5d4d399a74d1b546da11edac77df6aa3a61cd3d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pYAkkUEU.exe
                • Path C:\Users\Admin\XSsAAMok\pYAkkUEU.exe
                • Size 1.6MB
                • SHA256 635f60393d0801b016bd42f7e92ba21a74e804a8d16f40cb83486add1a1698cf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pYAkkUEU.inf
                • Path C:\Users\Admin\XSsAAMok\pYAkkUEU.inf
                • Size 4B
                • SHA256 f0540083f867de26d6a338e15475372477b52c4728fb9bd379f28c79c2b78ed4
                • MD5 SHA1 SHA512
                Submit Download

                memory/620-49-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/620-66-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/1320-203-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/1396-250-0x0000000000A40000-0x0000000000A60000-memory.dmp
                Download

                memory/1396-1778-0x0000000000A40000-0x0000000000A60000-memory.dmp
                Download

                memory/1396-9-0x0000000000400000-0x000000000058F000-memory.dmp
                Download

                memory/1396-1968-0x0000000000400000-0x000000000058F000-memory.dmp
                Download

                memory/1720-1978-0x0000000000400000-0x0000000000590000-memory.dmp
                Download

                memory/1720-21-0x0000000000400000-0x0000000000590000-memory.dmp
                Download

                memory/1780-112-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/1956-185-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/2000-141-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/2472-229-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/2960-1991-0x0000000000400000-0x0000000000590000-memory.dmp
                Download

                memory/3964-1973-0x0000000000400000-0x0000000000590000-memory.dmp
                Download

                memory/3964-17-0x0000000000400000-0x0000000000590000-memory.dmp
                Download

                memory/4300-215-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/4432-1986-0x0000000000400000-0x000000000058F000-memory.dmp
                Download

                memory/4444-93-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/4496-170-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/4528-0-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/4528-1-0x00000000021F0000-0x0000000002210000-memory.dmp
                Download

                memory/4528-32-0x00000000021F0000-0x0000000002210000-memory.dmp
                Download

                memory/4528-31-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/4572-239-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/4572-225-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/4988-45-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/5284-157-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/5564-127-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/5808-82-0x0000000000400000-0x0000000000593000-memory.dmp
                Download