Overview

overview

10

Static

static

3

2026-09-22...ck.exe

windows10-2004-x64

10

2026-09-22...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/09/2026, 20:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe
  • Size 1.6MB
  • Sample260922-yr8feaed53
  • SHA256 83835eb664e093a78fad5a0a20ba6604f5bc41ca23bb124755924cac4535c5b3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 16 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 16 IoCs
    defense_evasiontrojan
  • Renames multiple (120) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Drops file in System32 directory 10 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 16 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 32 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 48 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1280
    • C:\Users\Admin\CAwkIAoA\tmccwUIc.exe
      "C:\Users\Admin\CAwkIAoA\tmccwUIc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:4616
    • C:\ProgramData\dOoUcsMU\oaEEgAcY.exe
      "C:\ProgramData\dOoUcsMU\oaEEgAcY.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of FindShellTrayWindow
      PID:4428
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2348
      • C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5048
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3860
          • C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:692
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2644
              • C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3928
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4600
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:972
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:412
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock
                        11⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:3464
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:372
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock
                            13⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:4828
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock"
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:4440
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock
                                15⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:2440
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:2724
                                  • C:\Windows\System32\Conhost.exe
                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                    17⤵
                                      PID:4584
                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe
                                      C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock
                                      17⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:804
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock"
                                        18⤵
                                        • Executes a command shell one-liner
                                        • Suspicious use of WriteProcessMemory
                                        PID:1312
                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe
                                          C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock
                                          19⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:768
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock"
                                            20⤵
                                            • Executes a command shell one-liner
                                            PID:2396
                                            • C:\Windows\System32\Conhost.exe
                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              21⤵
                                                PID:4400
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe
                                                C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock
                                                21⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:4692
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock"
                                                  22⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3856
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock
                                                    23⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:448
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock"
                                                      24⤵
                                                      • Executes a command shell one-liner
                                                      PID:4424
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock
                                                        25⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:616
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock"
                                                          26⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3392
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe
                                                            C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock
                                                            27⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:4664
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock"
                                                              28⤵
                                                              • Executes a command shell one-liner
                                                              PID:4432
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe
                                                                C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock
                                                                29⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:3336
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock"
                                                                  30⤵
                                                                  • Executes a command shell one-liner
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:1868
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock
                                                                    31⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:4836
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock"
                                                                      32⤵
                                                                      • Executes a command shell one-liner
                                                                      PID:2448
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                      32⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies registry key
                                                                      PID:2156
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                      32⤵
                                                                      • Modifies registry key
                                                                      PID:1084
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                      32⤵
                                                                      • UAC bypass
                                                                      • Modifies registry key
                                                                      PID:404
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SUYsIUkA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe""
                                                                      32⤵
                                                                      • Executes a command shell one-liner
                                                                      PID:944
                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                        33⤵
                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                        PID:4216
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                  30⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry key
                                                                  PID:2768
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                  30⤵
                                                                  • Modifies registry key
                                                                  PID:4820
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                  30⤵
                                                                  • UAC bypass
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry key
                                                                  PID:1196
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yGUUgcoE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe""
                                                                  30⤵
                                                                  • Executes a command shell one-liner
                                                                  PID:2100
                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                    31⤵
                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4228
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                              28⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry key
                                                              PID:1508
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                              28⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry key
                                                              PID:2344
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                              28⤵
                                                              • UAC bypass
                                                              • Modifies registry key
                                                              PID:4160
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TeQEowgU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe""
                                                              28⤵
                                                              • Executes a command shell one-liner
                                                              PID:5020
                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                29⤵
                                                                • Executes a VBScript file via the Windows Script Host.
                                                                PID:1932
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                          26⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry key
                                                          PID:3480
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                          26⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry key
                                                          PID:1200
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                          26⤵
                                                          • UAC bypass
                                                          • Modifies registry key
                                                          PID:4132
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FmMMIcAI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe""
                                                          26⤵
                                                          • Executes a command shell one-liner
                                                          PID:4000
                                                          • C:\Windows\SysWOW64\cscript.exe
                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                            27⤵
                                                            • Executes a VBScript file via the Windows Script Host.
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1772
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                      24⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry key
                                                      PID:3836
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                      24⤵
                                                      • Modifies registry key
                                                      PID:3940
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                      24⤵
                                                      • UAC bypass
                                                      • Modifies registry key
                                                      PID:4936
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NOUUQUQQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe""
                                                      24⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4996
                                                      • C:\Windows\SysWOW64\cscript.exe
                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                        25⤵
                                                        • Executes a VBScript file via the Windows Script Host.
                                                        PID:3712
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                  22⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry key
                                                  PID:436
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                  22⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry key
                                                  PID:3832
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                  22⤵
                                                  • UAC bypass
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry key
                                                  PID:3056
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AcwAEAYM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe""
                                                  22⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3160
                                                  • C:\Windows\SysWOW64\cscript.exe
                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                    23⤵
                                                    • Executes a VBScript file via the Windows Script Host.
                                                    • System Location Discovery: System Language Discovery
                                                    PID:952
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                              20⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Modifies registry key
                                              PID:548
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                              20⤵
                                              • Modifies registry key
                                              PID:4084
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                              20⤵
                                              • UAC bypass
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry key
                                              PID:3512
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OiQckoEE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe""
                                              20⤵
                                              • Executes a command shell one-liner
                                              PID:2640
                                              • C:\Windows\SysWOW64\cscript.exe
                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                21⤵
                                                • Executes a VBScript file via the Windows Script Host.
                                                • System Location Discovery: System Language Discovery
                                                PID:5072
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                          18⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Modifies registry key
                                          PID:4700
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                          18⤵
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry key
                                          PID:4944
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                          18⤵
                                          • UAC bypass
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry key
                                          PID:4040
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ukookIEA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe""
                                          18⤵
                                          • Executes a command shell one-liner
                                          PID:4992
                                          • C:\Windows\SysWOW64\cscript.exe
                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                            19⤵
                                            • Executes a VBScript file via the Windows Script Host.
                                            • System Location Discovery: System Language Discovery
                                            PID:3776
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                      16⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry key
                                      PID:5000
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                      16⤵
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry key
                                      PID:1348
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                      16⤵
                                      • UAC bypass
                                      • Modifies registry key
                                      PID:3608
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HOEMMMcw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe""
                                      16⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:3740
                                      • C:\Windows\SysWOW64\cscript.exe
                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                        17⤵
                                        • Executes a VBScript file via the Windows Script Host.
                                        PID:3436
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                  14⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry key
                                  PID:4248
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                  14⤵
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry key
                                  PID:3964
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                  14⤵
                                  • UAC bypass
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry key
                                  PID:4660
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BIsgwoYc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe""
                                  14⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:3004
                                  • C:\Windows\SysWOW64\cscript.exe
                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                    15⤵
                                    • Executes a VBScript file via the Windows Script Host.
                                    • System Location Discovery: System Language Discovery
                                    PID:2768
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                              12⤵
                              • Modifies visibility of file extensions in Explorer
                              • System Location Discovery: System Language Discovery
                              • Modifies registry key
                              PID:204
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                              12⤵
                              • System Location Discovery: System Language Discovery
                              • Modifies registry key
                              PID:392
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                              12⤵
                              • UAC bypass
                              • System Location Discovery: System Language Discovery
                              • Modifies registry key
                              PID:4400
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jewkAwQw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe""
                              12⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:2244
                              • C:\Windows\SysWOW64\cscript.exe
                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                13⤵
                                • Executes a VBScript file via the Windows Script Host.
                                • System Location Discovery: System Language Discovery
                                PID:4432
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                          10⤵
                          • Modifies visibility of file extensions in Explorer
                          • Modifies registry key
                          PID:1228
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                          10⤵
                          • System Location Discovery: System Language Discovery
                          • Modifies registry key
                          PID:4492
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                          10⤵
                          • UAC bypass
                          • System Location Discovery: System Language Discovery
                          • Modifies registry key
                          PID:4000
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gwEMggQs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe""
                          10⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:2664
                          • C:\Windows\SysWOW64\cscript.exe
                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                            11⤵
                            • Executes a VBScript file via the Windows Script Host.
                            • System Location Discovery: System Language Discovery
                            PID:3392
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • System Location Discovery: System Language Discovery
                      • Modifies registry key
                      PID:1772
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                      8⤵
                      • Modifies registry key
                      PID:4584
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                      8⤵
                      • UAC bypass
                      • Modifies registry key
                      PID:448
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gQwoYMAI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe""
                      8⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:2532
                      • C:\Windows\SysWOW64\cscript.exe
                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                        9⤵
                        • Executes a VBScript file via the Windows Script Host.
                        • System Location Discovery: System Language Discovery
                        PID:1756
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                  6⤵
                  • Modifies visibility of file extensions in Explorer
                  • Modifies registry key
                  PID:1944
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry key
                  PID:1300
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                  6⤵
                  • UAC bypass
                  • System Location Discovery: System Language Discovery
                  • Modifies registry key
                  PID:4692
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BgQEIQME.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe""
                  6⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3416
                  • C:\Windows\SysWOW64\cscript.exe
                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                    7⤵
                    • Executes a VBScript file via the Windows Script Host.
                    • System Location Discovery: System Language Discovery
                    PID:4368
            • C:\Windows\SysWOW64\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
              4⤵
              • Modifies visibility of file extensions in Explorer
              • System Location Discovery: System Language Discovery
              • Modifies registry key
              PID:4820
            • C:\Windows\SysWOW64\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
              4⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry key
              PID:372
            • C:\Windows\SysWOW64\reg.exe
              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
              4⤵
              • UAC bypass
              • Modifies registry key
              PID:204
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ikYIMQcU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe""
              4⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4756
              • C:\Windows\SysWOW64\cscript.exe
                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                5⤵
                • Executes a VBScript file via the Windows Script Host.
                PID:1188
        • C:\Windows\SysWOW64\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
          2⤵
          • Modifies visibility of file extensions in Explorer
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:2732
        • C:\Windows\SysWOW64\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
          2⤵
          • Modifies registry key
          PID:2100
        • C:\Windows\SysWOW64\reg.exe
          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
          2⤵
          • UAC bypass
          • Modifies registry key
          PID:3252
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OmMEoUME.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock.exe""
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3448
          • C:\Windows\SysWOW64\cscript.exe
            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
            3⤵
            • Executes a VBScript file via the Windows Script Host.
            PID:2680
      • C:\ProgramData\NsEYwAso\cWQIswsI.exe
        C:\ProgramData\NsEYwAso\cWQIswsI.exe
        1⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        PID:860
      • C:\ProgramData\dOoUcsMU\oaEEgAcY.exe
        C:\ProgramData\dOoUcsMU\oaEEgAcY.exe
        1⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:3228
      • C:\Users\Admin\CAwkIAoA\tmccwUIc.exe
        C:\Users\Admin\CAwkIAoA\tmccwUIc.exe
        1⤵
        • Executes dropped EXE
        • Adds Run key to start application
        PID:4520
      • C:\Windows\System32\Conhost.exe
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        1⤵
          PID:1348
        • C:\Windows\servicing\TrustedInstaller.exe
          C:\Windows\servicing\TrustedInstaller.exe
          1⤵
            PID:2768

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                2
                T1059

                Visual Basic

                1
                T1059.005

                Windows Command Shell

                1
                T1059.003

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Privilege Escalation

                Abuse Elevation Control Mechanism

                1
                T1548

                Bypass User Account Control

                1
                T1548.002

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Defense Evasion

                Abuse Elevation Control Mechanism

                1
                T1548

                Bypass User Account Control

                1
                T1548.002

                Hide Artifacts

                1
                T1564

                Hidden Files and Directories

                1
                T1564.001

                Impair Defenses

                1
                T1562

                Disable or Modify Tools

                1
                T1562.001

                Modify Registry

                4
                T1112

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Query Registry

                1
                T1012

                System Information Discovery

                2
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                cWQIswsI.exe
                • Path C:\ProgramData\NsEYwAso\cWQIswsI.exe
                • Size 1.6MB
                • SHA256 4b22f5b5c509c55963901c3635332f2e975df568ae07ae0e0fb38c55f265c7e7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vcredist_x86.exe
                • Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                • Size 2.0MB
                • SHA256 6678efe42cc04d6b710313d83e94c5863f7d7c09754747ac424f992354f3f3ec
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                windowsdesktop-runtime-8.0.15-win-x64.exe
                • Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
                • Size 2.2MB
                • SHA256 532486159095d462dda5c554e713c4aae3fbf33ad61a9e79eb4311eae9675051
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vcredist_x86.exe
                • Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
                • Size 2.0MB
                • SHA256 067b704fad2dd279546b020d1edbc00bd6586f9f6efe863d12da5bdd76f57cee
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                oaEEgAcY.exe
                • Path C:\ProgramData\dOoUcsMU\oaEEgAcY.exe
                • Size 1.6MB
                • SHA256 b20adbfd820814ba5d5845fbd38739af0c919f4cdedaf0d724de20f4cda2d287
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                oaEEgAcY.inf
                • Path C:\ProgramData\dOoUcsMU\oaEEgAcY.inf
                • Size 4B
                • SHA256 200129f4b360d06f9c1064925a345bca9e4d1571b53c0ba36117e7885582ace6
                • MD5 SHA1 SHA512
                Submit Download

                oaEEgAcY.inf
                • Path C:\ProgramData\dOoUcsMU\oaEEgAcY.inf
                • Size 4B
                • SHA256 c38d914a6543bbb2e8d6d59598acdbc9ddad256a0f9de2eb912d8bb79a65af3d
                • MD5 SHA1 SHA512
                Submit Download

                oaEEgAcY.inf
                • Path C:\ProgramData\dOoUcsMU\oaEEgAcY.inf
                • Size 4B
                • SHA256 82da175e02e2c29a20b2d958e38c6cd381dd706ea67fe76dd63c8b4dcba1b80b
                • MD5 SHA1 SHA512
                Submit Download

                oaEEgAcY.inf
                • Path C:\ProgramData\dOoUcsMU\oaEEgAcY.inf
                • Size 4B
                • SHA256 d8e7485c12298722258fd74439b69302cd7e6d26e40da86492073e8af8b3edad
                • MD5 SHA1 SHA512
                Submit Download

                oaEEgAcY.inf
                • Path C:\ProgramData\dOoUcsMU\oaEEgAcY.inf
                • Size 4B
                • SHA256 838f9d20d2d11d6847c63264ef37dea7908bdd6fa72d769b85827efa0f1706d3
                • MD5 SHA1 SHA512
                Submit Download

                wKUg.txt
                • Path C:\ProgramData\wKUg.txt
                • Size 8KB
                • SHA256 c56d839221d79822462865490e9d186577c218389049400db8fee8de12256848
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                256.png.exe
                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png.exe
                • Size 1.6MB
                • SHA256 4fd65c17d9c58aa58eed1d9ca870443294256e81acda68952e86d3098960ae0c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                32.png.exe
                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png.exe
                • Size 1.6MB
                • SHA256 38d505c5b2c5a98aac89b44feba70e8537aa67a60e4aad7e8823e9a2f0f78a45
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                48.png.exe
                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png.exe
                • Size 1.6MB
                • SHA256 a6a72f920d2cc69bcba15135b52b339ff2ee7caeeb771dcfbd88e6b3807a2abf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                64.png.exe
                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png.exe
                • Size 1.6MB
                • SHA256 53ab31c6d0ae443ae3644d2597488b656bb56f9bb0e322864eac77b190574acd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                96.png.exe
                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png.exe
                • Size 1.6MB
                • SHA256 56c68dd9676cf2ca086f4014eeb4f3484efc20585fc49b9808a34eedf63521b6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                256.png.exe
                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png.exe
                • Size 1.6MB
                • SHA256 fe5bf2e73e4a74bf2720aef1f782c0db69d088aae0cf97bc9f3570a0c97372f8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                48.png.exe
                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png.exe
                • Size 1.6MB
                • SHA256 4ecf44476c51faba207063235ffb33bdd56dd5dace156dd3cb038d3ae3e64b3e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                128.png.exe
                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\128.png.exe
                • Size 1.6MB
                • SHA256 bdfaec601099aba0a6e4309cbe297c172873dcda70ee001a022739e3ab024767
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppBlue.png.exe
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png.exe
                • Size 1.6MB
                • SHA256 5b033d902ab0a259e9c5f0ac3e531778874fb4fa3f4b2b8709ea77a22f840e05
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppErrorBlue.png.exe
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png.exe
                • Size 1.6MB
                • SHA256 13a64dc83fa379211fb6127527440a87c327f97ec6096a891078c617340a088b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppErrorWhite.png.exe
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png.exe
                • Size 1.6MB
                • SHA256 174674ac824ff9fc4f6e7abb70bb66cc6505d7c73bec5c386a9d1ff3ef212a39
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppWhite.png.exe
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png.exe
                • Size 1.6MB
                • SHA256 fa2d27869a01465c34a5f7ad5644ada9321958ae8e7bcfe224f7f2d2453be03e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ElevatedAppWhite.png.exe
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png.exe
                • Size 1.6MB
                • SHA256 dd6cc4e312c844e9dd40060714d2acb001147f470ae6d645ee03837cd87af857
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OneDriveMedTile.scale-400.png.exe
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png.exe
                • Size 1.6MB
                • SHA256 4bc99dafa9e7339b146746e169b7574f02bfd45a556aa9546227a375c57b5d0a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OneDriveSmallTile.scale-400.png.exe
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png.exe
                • Size 1.6MB
                • SHA256 a0e169578c8881780f6c0dcc8d9121721d22f985121ad1e8cf38da2c281c1c82
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OneDrive.exe
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                • Size 3.1MB
                • SHA256 894b3556c2925dbd3b24ccc0ae20ea77bf3c0cb967a1c6c0746b6687d0835215
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                squaretile.png.exe
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png.exe
                • Size 1.6MB
                • SHA256 ffd11c0e4037e8bf9b1f7761cd79917aa0a0c2840256276bc6c60981a5849743
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tinytile.png.exe
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png.exe
                • Size 1.6MB
                • SHA256 faca4dea4d38f7463f501d34862bad8af554cd0f9b0272dff5ca39fea8e7aba2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                squaretile.png.exe
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png.exe
                • Size 1.6MB
                • SHA256 0fd62b9457c6cebfa865269ac0166b114b87463b70b374df2e4761cb009a9d96
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tinytile.png.exe
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png.exe
                • Size 1.6MB
                • SHA256 df9761bf0f4451dd81c28c46d2baa67c5305e2f76142601ad73accc8e795fe80
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                squaretile.png.exe
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png.exe
                • Size 1.6MB
                • SHA256 d02bb31ea0a21ec3f6c1d67c855286d54a4e6c76f0a70ecb3b4137c0dca8f3ac
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock
                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-22_670fb35a0abd4bdced6e9a23b4592ef9_elex_virlock
                • Size 5KB
                • SHA256 107b512cb4d2e8d9ad018bd9f3a23b3ecef929727ea7fe002174262a9947a093
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AAcQ.ico
                • Path C:\Users\Admin\AppData\Local\Temp\AAcQ.ico
                • Size 4KB
                • SHA256 57e72b9591e318a17feb74efa1262e9222814ad872437094734295700f669563
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AUME.exe
                • Path C:\Users\Admin\AppData\Local\Temp\AUME.exe
                • Size 2.2MB
                • SHA256 961943e8c8e943dbce338e92d39293bda0d129ee15ad58c6f47779fcb1ae42e7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AYkc.exe
                • Path C:\Users\Admin\AppData\Local\Temp\AYkc.exe
                • Size 1.6MB
                • SHA256 568670ea03deda5603b553104333b3a2a2e817451d71a70a63aeb4978e0c7046
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AqAI.ico
                • Path C:\Users\Admin\AppData\Local\Temp\AqAI.ico
                • Size 4KB
                • SHA256 0b945cd858463198a2319799f721202efb88f1b7273bc3726206f0bb272802f7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                CEMC.exe
                • Path C:\Users\Admin\AppData\Local\Temp\CEMC.exe
                • Size 1.6MB
                • SHA256 56a46f12ba85857a71747b332d873636152ef9be418ca0ab450a695a3ef345be
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                CIwG.exe
                • Path C:\Users\Admin\AppData\Local\Temp\CIwG.exe
                • Size 1.8MB
                • SHA256 69009d8c75c91a34da04c07fa7b7ff8def1250e38b6f847df7151d9a9cf28520
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                CQUY.exe
                • Path C:\Users\Admin\AppData\Local\Temp\CQUY.exe
                • Size 2.0MB
                • SHA256 aee6772043a837aaeee919b0b233030a0b08564a6e156f44bf57f608f2236005
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Cogk.exe
                • Path C:\Users\Admin\AppData\Local\Temp\Cogk.exe
                • Size 1.6MB
                • SHA256 c90aecd78d786054b3a572c50c90ded4dc9ed409b681b05a082b0d879721c025
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                EAMY.exe
                • Path C:\Users\Admin\AppData\Local\Temp\EAMY.exe
                • Size 1.8MB
                • SHA256 f3f93c86ed162d10323fe1843a1c5f0974d5df67685118515650cc2320335869
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                EAgg.exe
                • Path C:\Users\Admin\AppData\Local\Temp\EAgg.exe
                • Size 1.9MB
                • SHA256 ca2f16a2cb7cf68f600140685a3b3f3258149b01d50ce8bcfb78869160ec7dcf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                EEca.exe
                • Path C:\Users\Admin\AppData\Local\Temp\EEca.exe
                • Size 2.2MB
                • SHA256 928bbaf9cf5861aed2cde0e6de329eba7d7c6f76b4d7af8b199a7458f724d3d8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                EMQo.exe
                • Path C:\Users\Admin\AppData\Local\Temp\EMQo.exe
                • Size 1.6MB
                • SHA256 fb2715447b1cba760e6fb5ca8ea6d176aa4f8fa3a30ccf6bbcab75f017dac0b8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                EMwm.exe
                • Path C:\Users\Admin\AppData\Local\Temp\EMwm.exe
                • Size 1.6MB
                • SHA256 cdf8ab470917564f31c787df0ae44d30293b64d90530160d37a6d5867bf5df5b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                EgcI.exe
                • Path C:\Users\Admin\AppData\Local\Temp\EgcI.exe
                • Size 1.6MB
                • SHA256 cc3ee663487f8c244de31b5381aa934cd02512cd274f2da8cf1279cbcc0df0c4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Egkc.exe
                • Path C:\Users\Admin\AppData\Local\Temp\Egkc.exe
                • Size 1.6MB
                • SHA256 7f1a5f92386c98004d364b3843c820f8ded784bac4a1120e703f2aaa5c9c50ba
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                EoEo.exe
                • Path C:\Users\Admin\AppData\Local\Temp\EoEo.exe
                • Size 1.6MB
                • SHA256 7971b6d3f4a1583bf5c322b824c4f2bdaebcf3544984d86024c56d2c51868d2d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                EoYY.exe
                • Path C:\Users\Admin\AppData\Local\Temp\EoYY.exe
                • Size 2.2MB
                • SHA256 97be4da54652411cb23fc4095ce0df2261d95304c21621d5f072fd6cfb4d8908
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                GIsi.exe
                • Path C:\Users\Admin\AppData\Local\Temp\GIsi.exe
                • Size 2.0MB
                • SHA256 1ba4becafaa476483ae4dd55786e2b9e08490a9591ac2287383758dfe1f88610
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                GUwU.exe
                • Path C:\Users\Admin\AppData\Local\Temp\GUwU.exe
                • Size 2.0MB
                • SHA256 0ff771f920a6f9f2742e723c2eab47ad1d1e94a222985a3364352ee99b575861
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                GYgO.exe
                • Path C:\Users\Admin\AppData\Local\Temp\GYgO.exe
                • Size 1.6MB
                • SHA256 043d1fba1c1e3aaf26b4e6eb48ba040dee43cf1401d7d9196a2062454e5105ab
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                GcEo.exe
                • Path C:\Users\Admin\AppData\Local\Temp\GcEo.exe
                • Size 1.6MB
                • SHA256 94d9f26f29aaaa130705ba9288b297a6474f90b098c36b4ca4108fa05eddf800
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Gows.exe
                • Path C:\Users\Admin\AppData\Local\Temp\Gows.exe
                • Size 3.4MB
                • SHA256 9c3851e382d9c02a13c332a7f6c59cdd2ebf50a8508c4fe000cc1ec229217160
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                GsUw.ico
                • Path C:\Users\Admin\AppData\Local\Temp\GsUw.ico
                • Size 4KB
                • SHA256 991cf545088a00dd8a9710a6825444a4b045f3c1bf75822aeff058f2f37d9191
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                GwIm.exe
                • Path C:\Users\Admin\AppData\Local\Temp\GwIm.exe
                • Size 1.6MB
                • SHA256 ab1602198ef8926251916bb14489025e3a858a03546b0b576d97a65681525ec7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                GwoC.exe
                • Path C:\Users\Admin\AppData\Local\Temp\GwoC.exe
                • Size 1.6MB
                • SHA256 ba1bc27d94a8e0f59474584e8496353fda18396d5600853e5c9988895402da72
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                IQIo.exe
                • Path C:\Users\Admin\AppData\Local\Temp\IQIo.exe
                • Size 1.8MB
                • SHA256 855f18409fbca831f0af8b005f8c24d097a0269aa959decf3c7802d47de379ec
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                IgQa.exe
                • Path C:\Users\Admin\AppData\Local\Temp\IgQa.exe
                • Size 1.6MB
                • SHA256 aeacf054329dfc80df4e19fe9231fc9cbfe755dde415911f8e8f8b9a3633afb9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                IsUk.exe
                • Path C:\Users\Admin\AppData\Local\Temp\IsUk.exe
                • Size 1.6MB
                • SHA256 08261a9841ef9fb39f3324dddd4560d5fb33097787a1fc7997f1cb66a5ffcc12
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                IswK.exe
                • Path C:\Users\Admin\AppData\Local\Temp\IswK.exe
                • Size 1.6MB
                • SHA256 135475ce70fa4d7bfa7ba1e9dd8461b31545ce3b2dd406d9c6e37dcc0a5dd6b6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                KEEW.exe
                • Path C:\Users\Admin\AppData\Local\Temp\KEEW.exe
                • Size 1.8MB
                • SHA256 de07df9f1759ff5f65703029a601eb3c300e765e0c5b2ef7dab05bbb3f487206
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                KMwO.exe
                • Path C:\Users\Admin\AppData\Local\Temp\KMwO.exe
                • Size 1.6MB
                • SHA256 534032190f09c813f67c38c4f6d87c4ae56fc01567d3e5403dce63e437333890
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                KcQM.exe
                • Path C:\Users\Admin\AppData\Local\Temp\KcQM.exe
                • Size 1.6MB
                • SHA256 9b4481b9046e0cf3298aae0a5a0336d2e15823ad5e4525042605932f5321c28c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Kckw.exe
                • Path C:\Users\Admin\AppData\Local\Temp\Kckw.exe
                • Size 1.8MB
                • SHA256 30ee69c0b37f0614436edfe04520e86ac5e376d9f3e7a9c02d2a9b2f951e61b5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                KscU.exe
                • Path C:\Users\Admin\AppData\Local\Temp\KscU.exe
                • Size 2.2MB
                • SHA256 3f18d19a1019bbdc31b5749dab48b07a31580867abfa5d2fbd3dde4fbc19e26e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MgsA.exe
                • Path C:\Users\Admin\AppData\Local\Temp\MgsA.exe
                • Size 1.6MB
                • SHA256 9b31f63ed5807bb3f772451825d2a2bf66f5a816247fba51093641fb1f031ed3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MwQS.exe
                • Path C:\Users\Admin\AppData\Local\Temp\MwQS.exe
                • Size 1.6MB
                • SHA256 3fff1e2d2bcf512dfbfd3036e48fc5a648180d142992833e1d6ef6afaf2a3cb6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OcQA.exe
                • Path C:\Users\Admin\AppData\Local\Temp\OcQA.exe
                • Size 1.6MB
                • SHA256 4a348bdfa3f60ac3c91ba7b71e28c098fe6783856037b197fafe59137e2c95c0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OmMEoUME.bat
                • Path C:\Users\Admin\AppData\Local\Temp\OmMEoUME.bat
                • Size 112B
                • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Omoo.ico
                • Path C:\Users\Admin\AppData\Local\Temp\Omoo.ico
                • Size 4KB
                • SHA256 114dae4c54ca426f78e50998727dac92942261d71ca5b2dbaf413794dcf8ad82
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                QAsQ.ico
                • Path C:\Users\Admin\AppData\Local\Temp\QAsQ.ico
                • Size 4KB
                • SHA256 135efe6cdc9df0beb185988bd2d639db8a293dd89dcb7fc900e5ac839629c715
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                QsIM.exe
                • Path C:\Users\Admin\AppData\Local\Temp\QsIM.exe
                • Size 1.6MB
                • SHA256 185f672d53b9571e369b36be7b2732526b0b378c27599e5740b1859e2b4757bb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SEko.exe
                • Path C:\Users\Admin\AppData\Local\Temp\SEko.exe
                • Size 1.6MB
                • SHA256 0e8989145aa6e0a2774acea67e0ffe7402944071bc77bf8ab790ce9387fb16c5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SMIU.exe
                • Path C:\Users\Admin\AppData\Local\Temp\SMIU.exe
                • Size 2.1MB
                • SHA256 d82706a401cb60513ff175beef3539a4cbb145375a58c993626dbbe094ef9b7b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SQAy.exe
                • Path C:\Users\Admin\AppData\Local\Temp\SQAy.exe
                • Size 2.2MB
                • SHA256 cf58b6f5097f20d9edc3cb9d2437236af61e987b607eb3dada79cfe2d03927c8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SQEw.exe
                • Path C:\Users\Admin\AppData\Local\Temp\SQEw.exe
                • Size 1.6MB
                • SHA256 008118b8f56a1b89c7a084d3791fd2b76bfc77aa3d5cf6cf65110c4129155d81
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SQIY.exe
                • Path C:\Users\Admin\AppData\Local\Temp\SQIY.exe
                • Size 1.6MB
                • SHA256 1c658a1587c07713ea8d99ec2532763eed422193773ab72b8fc11fc92e96b1a3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SYUS.exe
                • Path C:\Users\Admin\AppData\Local\Temp\SYUS.exe
                • Size 7.3MB
                • SHA256 68eb935d850a51d5328052174b62c7f44b258573ef312af6f809fe7b80186fb8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Skcm.exe
                • Path C:\Users\Admin\AppData\Local\Temp\Skcm.exe
                • Size 1.9MB
                • SHA256 688dfef53a3ec6eb7bcc0ed85a367fe32f52cf2df1559b67a24bb5525d29f782
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SwQe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\SwQe.exe
                • Size 1.6MB
                • SHA256 ae7330655bc618b4a1bf0cdfbb49da1c4073cc830cd75e30aa0e5a05d7be7bf8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                UIMo.exe
                • Path C:\Users\Admin\AppData\Local\Temp\UIMo.exe
                • Size 1.7MB
                • SHA256 86c5f62edbe58806e5a81eea5ecd07f43719f7437f428863bed94a6f1fdf3003
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                UUEM.exe
                • Path C:\Users\Admin\AppData\Local\Temp\UUEM.exe
                • Size 1.7MB
                • SHA256 2466dc26ac53c7a1def59a34e716cd35314b109c6f53464c4435f4a24ab5546f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                UcES.exe
                • Path C:\Users\Admin\AppData\Local\Temp\UcES.exe
                • Size 1.9MB
                • SHA256 9699135883156d86158079e5f720754376b966748a93783885192cd289c0eb85
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WIIy.exe
                • Path C:\Users\Admin\AppData\Local\Temp\WIIy.exe
                • Size 1.6MB
                • SHA256 68e0e7f20d6574296076643ea35d1fd3dcf86422c124f304bd8b6633afdaf240
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WMoO.exe
                • Path C:\Users\Admin\AppData\Local\Temp\WMoO.exe
                • Size 2.1MB
                • SHA256 ffa4566c32ebcd757b2a00b8a2059b22d4cfa9f1f23e8714c4acec37a1edceae
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WUUy.exe
                • Path C:\Users\Admin\AppData\Local\Temp\WUUy.exe
                • Size 1.6MB
                • SHA256 6a053867318da125e0f4d6aab66358095bda29c03b32014812783ed78651174e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                YEoA.exe
                • Path C:\Users\Admin\AppData\Local\Temp\YEoA.exe
                • Size 2.1MB
                • SHA256 8f0caaaba9cb4b1892a1c4ea7b82d20aba391567b07ffb07a095461b630e026f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                YMUg.exe
                • Path C:\Users\Admin\AppData\Local\Temp\YMUg.exe
                • Size 1.8MB
                • SHA256 70e03e9ad49e67fe15fed9fd5bcb7b03c69a41abc95f6497aadf5298638308db
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                YUgM.exe
                • Path C:\Users\Admin\AppData\Local\Temp\YUgM.exe
                • Size 1.6MB
                • SHA256 4493a753180d6a450f4b987574e26a56802e00480dc05ebec7496c8c27d0b3a9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                YgMg.exe
                • Path C:\Users\Admin\AppData\Local\Temp\YgMg.exe
                • Size 1.6MB
                • SHA256 2fb22b2c58642ff26f9581e324dbd5625301663c968c9a9376119fc28ea5d8d2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                YokU.exe
                • Path C:\Users\Admin\AppData\Local\Temp\YokU.exe
                • Size 1.6MB
                • SHA256 3aece36ce25258fa117cc6fe06ac413183679d37741afad7f8ed7809796f646d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                YooG.exe
                • Path C:\Users\Admin\AppData\Local\Temp\YooG.exe
                • Size 1.6MB
                • SHA256 1d328c69e856d432065216837ea3a27f1afdddb1a3cdec83a03e47011600e25f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                aUAu.exe
                • Path C:\Users\Admin\AppData\Local\Temp\aUAu.exe
                • Size 1.6MB
                • SHA256 5073e2d2cded56d6dcd2bcc2dc4c709a650c4c6169e8e2d5cf8cf7947d9e40f9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                aUgQ.exe
                • Path C:\Users\Admin\AppData\Local\Temp\aUgQ.exe
                • Size 1.6MB
                • SHA256 697a443991faa78bda3f77af113630cb5c3c486eca94f07d5460d5d18b2835c7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                asQM.exe
                • Path C:\Users\Admin\AppData\Local\Temp\asQM.exe
                • Size 2.0MB
                • SHA256 bedc990a6f1c13f824e2c58a6e036123adb2c904577e4d2302cf411137ce71cf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cAUW.exe
                • Path C:\Users\Admin\AppData\Local\Temp\cAUW.exe
                • Size 1.6MB
                • SHA256 5814b25bd008e84c98045ed4bc6ca61a323fffd7af485183516508bc5792ba43
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cMYG.exe
                • Path C:\Users\Admin\AppData\Local\Temp\cMYG.exe
                • Size 2.1MB
                • SHA256 66a7898fd05db8e4e98d3bbf5c2b46e66b91f430249189238f6da8c4253d9026
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                eAMG.exe
                • Path C:\Users\Admin\AppData\Local\Temp\eAMG.exe
                • Size 1.9MB
                • SHA256 c0627e1273642d1fd8556601597213402b8c6efa71e175bb31ca65e610bbb0da
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                eIYK.exe
                • Path C:\Users\Admin\AppData\Local\Temp\eIYK.exe
                • Size 1.9MB
                • SHA256 2d730bc07dbc64cbf1042a450774af2d79de10fc099e8f7fb90587c24c0adfba
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                eIoS.exe
                • Path C:\Users\Admin\AppData\Local\Temp\eIoS.exe
                • Size 2.0MB
                • SHA256 f381425554e823160b493d38b8851b5523fd93a182fb0f523eaedbcb0c9d5086
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ewow.exe
                • Path C:\Users\Admin\AppData\Local\Temp\ewow.exe
                • Size 2.2MB
                • SHA256 9a4a7c4b39ce06b0c2457c4bffdc3ce32f5394a864eb81072b790ea26ff13536
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                file.vbs
                • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                • Size 19B
                • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                • MD5 SHA1 SHA512
                Submit Download

                gMsU.exe
                • Path C:\Users\Admin\AppData\Local\Temp\gMsU.exe
                • Size 1.9MB
                • SHA256 78d5d945f9f2da22103dc71531aa8faf70d47246b6277340e30feea551fa76a9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                gokY.exe
                • Path C:\Users\Admin\AppData\Local\Temp\gokY.exe
                • Size 1.6MB
                • SHA256 dc54b90f644c299b930496400332136cd4f45957e438941a6104dcce9faa4601
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                iQUi.exe
                • Path C:\Users\Admin\AppData\Local\Temp\iQUi.exe
                • Size 2.0MB
                • SHA256 bea76c1e2c2d5297ce7c386fd94802fcf723b8170b36725d311dffacde90c894
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                iUoE.exe
                • Path C:\Users\Admin\AppData\Local\Temp\iUoE.exe
                • Size 1.7MB
                • SHA256 ec71410bc3a7c84f8832b07ca01787c01ce9a2f934fe1678ef6c5537da5ae875
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ioou.exe
                • Path C:\Users\Admin\AppData\Local\Temp\ioou.exe
                • Size 2.1MB
                • SHA256 abd02a22f6a36a24976f5696be682d6dfb2d7404125a17d06fa7becb01c0a592
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                iwMS.exe
                • Path C:\Users\Admin\AppData\Local\Temp\iwMS.exe
                • Size 1.6MB
                • SHA256 45b68f6cd4b55d0195e26ce0a752a7bc423a7aa782b3b8d1ec8541bb44beb6cc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                kAou.exe
                • Path C:\Users\Admin\AppData\Local\Temp\kAou.exe
                • Size 2.0MB
                • SHA256 f0c5c81be6dacc10dbcce9b0af0f773c684749ae9e20491e7a343d727c2ed331
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                kEgq.exe
                • Path C:\Users\Admin\AppData\Local\Temp\kEgq.exe
                • Size 2.5MB
                • SHA256 e9295a680330ab86659a33d6c801d1b2f682ec12fe17775b4c5db9350cc563fc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                kMIm.exe
                • Path C:\Users\Admin\AppData\Local\Temp\kMIm.exe
                • Size 1.6MB
                • SHA256 7cebfb754475d7f82bc03d40ac835f7ef5ff90480175e43b7bd5c9f0fdcbc776
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                kaYU.ico
                • Path C:\Users\Admin\AppData\Local\Temp\kaYU.ico
                • Size 4KB
                • SHA256 684e75b6fdb9a7203e03c630a66a3710ace32aa78581311ba38e3f26737feae6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                kcsQ.exe
                • Path C:\Users\Admin\AppData\Local\Temp\kcsQ.exe
                • Size 3.5MB
                • SHA256 115b049bb86ec805058c0886ad8b7fe8234693944ca5d3e7891cabf18e4fdd9f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                kegw.ico
                • Path C:\Users\Admin\AppData\Local\Temp\kegw.ico
                • Size 4KB
                • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                kkQu.exe
                • Path C:\Users\Admin\AppData\Local\Temp\kkQu.exe
                • Size 1.6MB
                • SHA256 4bee7f17c93f31d9d583795222389936f2c21820ef78aa25c92f34df47020c16
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                kkgS.exe
                • Path C:\Users\Admin\AppData\Local\Temp\kkgS.exe
                • Size 1.6MB
                • SHA256 cac4749333dca47181a4dc1ce01610aa704c3fd5b8b89e2767044785b1ee0348
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                kksY.exe
                • Path C:\Users\Admin\AppData\Local\Temp\kksY.exe
                • Size 1.7MB
                • SHA256 6ad32159fa3a7608edd8576aaf992968625874052e5c64b8399b5512946f6396
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                koUs.exe
                • Path C:\Users\Admin\AppData\Local\Temp\koUs.exe
                • Size 1.9MB
                • SHA256 515976810b5a7d5501dc8035e34ebf8d8ae4b20b7b27a485a1d06a0364560fae
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                mAIe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\mAIe.exe
                • Size 1.9MB
                • SHA256 aa3218137836b5a25c1d2ed3e1f07700bb35022473a14156e8424a5ab4832bd7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                mAgk.exe
                • Path C:\Users\Admin\AppData\Local\Temp\mAgk.exe
                • Size 1.6MB
                • SHA256 5ed3b057818d2f80b53073ace5455bf6f8558599ae34030299889e57106e1004
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                mUYa.exe
                • Path C:\Users\Admin\AppData\Local\Temp\mUYa.exe
                • Size 2.2MB
                • SHA256 e1ffc24206fb62cb5015b857cfbe9a0f6fc31c1c03cb361727cc3a9d0059551f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                mUYq.exe
                • Path C:\Users\Admin\AppData\Local\Temp\mUYq.exe
                • Size 2.2MB
                • SHA256 15fc427ca55797a71b02c1ac4270e3e2c61b7d2754dcc2d78612e202fc908c5b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                oAsQ.exe
                • Path C:\Users\Admin\AppData\Local\Temp\oAsQ.exe
                • Size 2.2MB
                • SHA256 ec2cdaebde474fc6cfd621f9e9a9672c48884eb9643013d243aaf83c8d676f43
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                oIMg.exe
                • Path C:\Users\Admin\AppData\Local\Temp\oIMg.exe
                • Size 1.9MB
                • SHA256 72246d916ab911d03324a470b48b38ebf02e50179eb89f2e0e2d08744de48c21
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                oMMw.exe
                • Path C:\Users\Admin\AppData\Local\Temp\oMMw.exe
                • Size 1.8MB
                • SHA256 27096aa8dd50a02c0518c2a2c4af7559db98d0f6de2db01e42b64c1169dbaee6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                oQog.exe
                • Path C:\Users\Admin\AppData\Local\Temp\oQog.exe
                • Size 1.6MB
                • SHA256 4c17dec1c206d73e7478885a06e6fc0ee5b89e9a0c9c49de1c4ca952b40353c5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                oeAQ.ico
                • Path C:\Users\Admin\AppData\Local\Temp\oeAQ.ico
                • Size 4KB
                • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                osUW.exe
                • Path C:\Users\Admin\AppData\Local\Temp\osUW.exe
                • Size 1.8MB
                • SHA256 46ecc1514c753846f075bad260fa063d352a5278c205c5f7c84484879e32eb74
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                owkg.exe
                • Path C:\Users\Admin\AppData\Local\Temp\owkg.exe
                • Size 1.6MB
                • SHA256 1834d5df2c5a201d4d31984b874f0294e5cf9bbe6d0cdabe28740cd567696139
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qQIm.exe
                • Path C:\Users\Admin\AppData\Local\Temp\qQIm.exe
                • Size 1.6MB
                • SHA256 c5a86c398590598d5bd5fa6b8be7724548f68b065ba111620d985045c4e1b2a2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qYcm.exe
                • Path C:\Users\Admin\AppData\Local\Temp\qYcm.exe
                • Size 1.6MB
                • SHA256 b341f8021615593de99df82d9aaaeb9b022fc5e3ed90431b0d70eb07c05edfa8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qksY.exe
                • Path C:\Users\Admin\AppData\Local\Temp\qksY.exe
                • Size 1.7MB
                • SHA256 f924ff3f7d5373611956bb5cd395791238ee1be1b1cd3123b4afb37553dcf1aa
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qowc.exe
                • Path C:\Users\Admin\AppData\Local\Temp\qowc.exe
                • Size 1.6MB
                • SHA256 516731c5d1d970cbf68c5fc9ce157085c2c57e234a46742f9edc14b90ce729b0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qsUi.exe
                • Path C:\Users\Admin\AppData\Local\Temp\qsUi.exe
                • Size 2.0MB
                • SHA256 e4d55947582b73996ce4d41a51857b871f9d6b327849f6bff76188b0897a027c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qwAm.exe
                • Path C:\Users\Admin\AppData\Local\Temp\qwAm.exe
                • Size 2.1MB
                • SHA256 9193208bee2a513e3f109394048d2c82274f5c2a46a92f031a487d4ec11a34eb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qwMW.exe
                • Path C:\Users\Admin\AppData\Local\Temp\qwMW.exe
                • Size 1.6MB
                • SHA256 60d80ab3d2bd53f04673cff7bea042ee3634f3f13ff97735f9e36d80f6247c51
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qwka.exe
                • Path C:\Users\Admin\AppData\Local\Temp\qwka.exe
                • Size 1.6MB
                • SHA256 c9c8ef2090ad35fe4a53f97778b985470caf433712fd0d171259f76a90e6ebab
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                uMYk.exe
                • Path C:\Users\Admin\AppData\Local\Temp\uMYk.exe
                • Size 1.6MB
                • SHA256 8a6725441095aa161bccea0ff32fac36bf990b4b771f1651e93a0a92d8039a35
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                uQkY.exe
                • Path C:\Users\Admin\AppData\Local\Temp\uQkY.exe
                • Size 1.6MB
                • SHA256 30ce509b07619cdb2557c73c30ac766f4b8d117ca2a8c4902c06e5ccac6dce5c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ueMc.ico
                • Path C:\Users\Admin\AppData\Local\Temp\ueMc.ico
                • Size 4KB
                • SHA256 be3e79875f3e84bab8ed51f6028b198f5e8472c60dcedf757af2e1bdf2aa5742
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ugcM.exe
                • Path C:\Users\Admin\AppData\Local\Temp\ugcM.exe
                • Size 2.2MB
                • SHA256 5c7a6c62df630d3c5e4b23401a74d0304f5976f578dfb1058f913ddc1613f8af
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wIIw.exe
                • Path C:\Users\Admin\AppData\Local\Temp\wIIw.exe
                • Size 2.1MB
                • SHA256 0879ce9b8179caead0ce0fe5d045fb0b595e6f75500591a965fba182360f3a31
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wUIG.exe
                • Path C:\Users\Admin\AppData\Local\Temp\wUIG.exe
                • Size 1.6MB
                • SHA256 df0b99152a945fc6e36c6adba1aef4a1f2a0cb8949ce6c3dfbae1ad246b49e70
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wUcW.exe
                • Path C:\Users\Admin\AppData\Local\Temp\wUcW.exe
                • Size 1.6MB
                • SHA256 b08d99e53ae0348eaa1fed75aef173845919333a5eb7005338eb938a73d472c7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wccw.exe
                • Path C:\Users\Admin\AppData\Local\Temp\wccw.exe
                • Size 1.9MB
                • SHA256 9cc2d1f5b91b85ecef39ff20c9d51c37fe8773d5f1652537985d75474a70af9c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wgUI.ico
                • Path C:\Users\Admin\AppData\Local\Temp\wgUI.ico
                • Size 4KB
                • SHA256 daa05353be57bb7c4de23a63af8aac3f0c45fba8c1b40acac53e33240fbc25cd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wsUg.exe
                • Path C:\Users\Admin\AppData\Local\Temp\wsUg.exe
                • Size 1.6MB
                • SHA256 e85a128aaaeb8aee95735c1c1be9ee90696e13c32772f0660ac3632117aaeab0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                yAIQ.exe
                • Path C:\Users\Admin\AppData\Local\Temp\yAIQ.exe
                • Size 2.0MB
                • SHA256 1bdca7917eeb3bf3ab49d9c59ffbf767bc56a50b691d240aba21155b760bda68
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                yIMo.exe
                • Path C:\Users\Admin\AppData\Local\Temp\yIMo.exe
                • Size 1.6MB
                • SHA256 588334d28f6513bdd759aa2d4801b1c19ab24b56305eea6524a460da98af2654
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                yYES.exe
                • Path C:\Users\Admin\AppData\Local\Temp\yYES.exe
                • Size 2.3MB
                • SHA256 8d39b76f779a945cd13dad0d0088d9844454e71a9235efb384c4bc3fe0dc2519
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                yoIg.exe
                • Path C:\Users\Admin\AppData\Local\Temp\yoIg.exe
                • Size 1.8MB
                • SHA256 d0da51677ea02a2f2f50f57447dd5e0022c8d65bcf118a160ae98376b4cbbbc9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                yskk.exe
                • Path C:\Users\Admin\AppData\Local\Temp\yskk.exe
                • Size 1.6MB
                • SHA256 e96fb47490ba4363a8c9b62ed5a87d4ff7babd79d25b699b4e5029c5ecb634e8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SearchEnter.xlsx.exe
                • Path C:\Users\Admin\AppData\Roaming\DebugInvoke\SearchEnter.xlsx.exe
                • Size 3.1MB
                • SHA256 72a140bcc461ea08e5327a284827237be9fe2bfeeece7e6abd0c04b5deb48bad
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SelectResize.wma.exe
                • Path C:\Users\Admin\AppData\Roaming\RenameCopy\SelectResize.wma.exe
                • Size 2.0MB
                • SHA256 ba90c0856ac718e68fc2d9d004e20ec9de4cb0e42e266a869fc749461fa40d2e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                StopAdd.wma.exe
                • Path C:\Users\Admin\AppData\Roaming\RenameCopy\StopAdd.wma.exe
                • Size 2.1MB
                • SHA256 8d3ec5be724d48fd0a6a6cef8ca57475ef5e35dddf9a64982e03c65c4ec9a950
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                EnterSubmit.zip.exe
                • Path C:\Users\Admin\AppData\Roaming\SaveFind\EnterSubmit.zip.exe
                • Size 1.8MB
                • SHA256 69392eed511ced6152232054fef55afe695aefdc710df451f1a1a6a9878db234
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RestartConvert.bmp.exe
                • Path C:\Users\Admin\AppData\Roaming\UnblockExpand\RestartConvert.bmp.exe
                • Size 2.0MB
                • SHA256 313861850f80a9c8bc4ef06995db4d6f985a39114ff4a7fb305775e68b0a612b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                StepSync.exe
                • Path C:\Users\Admin\AppData\Roaming\UnblockExpand\StepSync.exe
                • Size 2.2MB
                • SHA256 91e7eabfda5d6bfcee8400d0a69771e2bef087c97066a266200c7047bd37d2b0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SuspendPop.docx.exe
                • Path C:\Users\Admin\AppData\Roaming\UndoStop\SuspendPop.docx.exe
                • Size 2.9MB
                • SHA256 36a2e58e6bd0ae612143c6a3f630c14e7fb9971ce006ed41773e69ea81f8c963
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tmccwUIc.exe
                • Path C:\Users\Admin\CAwkIAoA\tmccwUIc.exe
                • Size 1.6MB
                • SHA256 a881c41aca1a55bb9109c5977890d85b57363df73adaa4af3c2cf7a702c3f620
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/448-179-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/448-163-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/616-196-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/616-176-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/692-50-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/692-35-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/768-137-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/768-154-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/804-136-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/804-121-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/860-2161-0x0000000000400000-0x0000000000591000-memory.dmp
                Download

                memory/860-18-0x0000000000400000-0x0000000000591000-memory.dmp
                Download

                memory/972-72-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/972-83-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/1280-28-0x0000000004020000-0x0000000004040000-memory.dmp
                Download

                memory/1280-27-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/1280-0-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/1280-1-0x0000000004020000-0x0000000004040000-memory.dmp
                Download

                memory/2440-126-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/2440-115-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/3228-52-0x0000000000400000-0x0000000000590000-memory.dmp
                Download

                memory/3228-2174-0x0000000000400000-0x0000000000590000-memory.dmp
                Download

                memory/3336-220-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/3336-210-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/3464-96-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/3464-80-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/3928-56-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/3928-69-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/4428-2156-0x0000000000400000-0x0000000000590000-memory.dmp
                Download

                memory/4428-15-0x0000000000400000-0x0000000000590000-memory.dmp
                Download

                memory/4520-57-0x0000000000400000-0x0000000000591000-memory.dmp
                Download

                memory/4520-2179-0x0000000000400000-0x0000000000591000-memory.dmp
                Download

                memory/4616-10-0x0000000000400000-0x0000000000591000-memory.dmp
                Download

                memory/4616-2151-0x0000000000400000-0x0000000000591000-memory.dmp
                Download

                memory/4664-193-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/4664-205-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/4692-151-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/4692-168-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/4828-111-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/4828-93-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/4836-227-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/4836-217-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/5048-38-0x0000000000400000-0x0000000000593000-memory.dmp
                Download

                memory/5048-24-0x0000000000400000-0x0000000000593000-memory.dmp
                Download