Overview

overview

10

Static

static

3

2026-06-27...ck.exe

windows10-2004-x64

10

2026-06-27...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 09:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe
  • Size 1.6MB
  • Sample260629-k33gmsbw2p
  • SHA256 7c7512bba7d4baecc94a0903a37b02ca3f38a9492c661fd35c1810e71ca70485
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverynabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 17 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 17 IoCs
    defense_evasiontrojan
  • Renames multiple (104) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 51 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3712
    • C:\Users\Admin\ZAEIYUcY\MUMUwYYc.exe
      "C:\Users\Admin\ZAEIYUcY\MUMUwYYc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:3524
    • C:\ProgramData\TCEQkEcE\XSUIcgYs.exe
      "C:\ProgramData\TCEQkEcE\XSUIcgYs.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:1464
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1496
      • C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1208
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4236
          • C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2960
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1560
              • C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:5440
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4964
                  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:1780
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock"
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3452
                      • C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock
                        11⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:1236
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock"
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2468
                          • C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock
                            13⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:1820
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock"
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5824
                              • C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock
                                15⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:6072
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock"
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:3236
                                  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:4780
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock"
                                      18⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:3248
                                      • C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock
                                        19⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:3284
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock"
                                          20⤵
                                            PID:6104
                                            • C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe
                                              C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock
                                              21⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4200
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock"
                                                22⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:4212
                                                • C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe
                                                  C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock
                                                  23⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4748
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock"
                                                    24⤵
                                                      PID:1824
                                                      • C:\Windows\System32\Conhost.exe
                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        25⤵
                                                          PID:5340
                                                        • C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe
                                                          C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock
                                                          25⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:4696
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock"
                                                            26⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2384
                                                            • C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe
                                                              C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock
                                                              27⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:828
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock"
                                                                28⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5372
                                                                • C:\Windows\System32\Conhost.exe
                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  29⤵
                                                                    PID:468
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock
                                                                    29⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:6136
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock"
                                                                      30⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:460
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock
                                                                        31⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:4092
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock"
                                                                          32⤵
                                                                            PID:3184
                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock
                                                                              33⤵
                                                                                PID:4156
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock"
                                                                                  34⤵
                                                                                    PID:2656
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                    34⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • Modifies registry key
                                                                                    PID:4604
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                    34⤵
                                                                                    • Modifies registry key
                                                                                    PID:3328
                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                      35⤵
                                                                                        PID:4568
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                      34⤵
                                                                                      • UAC bypass
                                                                                      • Modifies registry key
                                                                                      PID:1288
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pEoQMUMM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe""
                                                                                      34⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:952
                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                        35⤵
                                                                                          PID:5676
                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                          35⤵
                                                                                            PID:5356
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                      32⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Modifies registry key
                                                                                      PID:2336
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                      32⤵
                                                                                      • Modifies registry key
                                                                                      PID:5520
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                      32⤵
                                                                                      • UAC bypass
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Modifies registry key
                                                                                      PID:2200
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XWIwcMQk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe""
                                                                                      32⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2664
                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                        33⤵
                                                                                          PID:3140
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                    30⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Modifies registry key
                                                                                    PID:4088
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                    30⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Modifies registry key
                                                                                    PID:2104
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                    30⤵
                                                                                    • UAC bypass
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Modifies registry key
                                                                                    PID:3412
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iAggMQow.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe""
                                                                                    30⤵
                                                                                      PID:5688
                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                        31⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:5284
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                  28⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • Modifies registry key
                                                                                  PID:2148
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                  28⤵
                                                                                  • Modifies registry key
                                                                                  PID:6016
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                  28⤵
                                                                                  • UAC bypass
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Modifies registry key
                                                                                  PID:1940
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\suggsgMU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe""
                                                                                  28⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:2716
                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                    29⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:4700
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                              26⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies registry key
                                                                              PID:5396
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                              26⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies registry key
                                                                              PID:1060
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                              26⤵
                                                                              • UAC bypass
                                                                              • Modifies registry key
                                                                              PID:5412
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\haoYMcoc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe""
                                                                              26⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:4556
                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                27⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:3528
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                          24⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Modifies registry key
                                                                          PID:1420
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                          24⤵
                                                                          • Modifies registry key
                                                                          PID:4420
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                          24⤵
                                                                          • UAC bypass
                                                                          • Modifies registry key
                                                                          PID:3920
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DYgwgcAg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe""
                                                                          24⤵
                                                                            PID:2940
                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                              25⤵
                                                                                PID:5612
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                          22⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Modifies registry key
                                                                          PID:5388
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                          22⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Modifies registry key
                                                                          PID:5864
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                          22⤵
                                                                          • UAC bypass
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Modifies registry key
                                                                          PID:5676
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bsEcUoko.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe""
                                                                          22⤵
                                                                            PID:4624
                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                              23⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5092
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                        20⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Modifies registry key
                                                                        PID:1040
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                        20⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Modifies registry key
                                                                        PID:2632
                                                                        • C:\Windows\System32\Conhost.exe
                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                          21⤵
                                                                            PID:4656
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                          20⤵
                                                                          • UAC bypass
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Modifies registry key
                                                                          PID:2612
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cwYAcsMw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe""
                                                                          20⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:5200
                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                            21⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:6132
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                      18⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Modifies registry key
                                                                      PID:2624
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                      18⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies registry key
                                                                      PID:2104
                                                                      • C:\Windows\System32\Conhost.exe
                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        19⤵
                                                                          PID:4168
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                        18⤵
                                                                        • UAC bypass
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Modifies registry key
                                                                        PID:5980
                                                                        • C:\Windows\System32\Conhost.exe
                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                          19⤵
                                                                            PID:3804
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iIggowII.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe""
                                                                          18⤵
                                                                            PID:824
                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                              19⤵
                                                                                PID:4092
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                          16⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Modifies registry key
                                                                          PID:468
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                          16⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Modifies registry key
                                                                          PID:6016
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                          16⤵
                                                                          • UAC bypass
                                                                          • Modifies registry key
                                                                          PID:3340
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SAwAUYYo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe""
                                                                          16⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1528
                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                            17⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:3036
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                      14⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Modifies registry key
                                                                      PID:2332
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                      14⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies registry key
                                                                      PID:3324
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                      14⤵
                                                                      • UAC bypass
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies registry key
                                                                      PID:2844
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PEEQsAUE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe""
                                                                      14⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2704
                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                        15⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:5740
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                  12⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry key
                                                                  PID:5340
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                  12⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry key
                                                                  PID:5356
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                  12⤵
                                                                  • UAC bypass
                                                                  • Modifies registry key
                                                                  PID:2376
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tcYwswYQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe""
                                                                  12⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5620
                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                    13⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4408
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                              10⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Modifies registry key
                                                              PID:3552
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                              10⤵
                                                              • Modifies registry key
                                                              PID:4568
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                              10⤵
                                                              • UAC bypass
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry key
                                                              PID:5880
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DwYAsIws.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe""
                                                              10⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5136
                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                11⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5696
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                          8⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry key
                                                          PID:4656
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                          8⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry key
                                                          PID:5928
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                          8⤵
                                                          • UAC bypass
                                                          • Modifies registry key
                                                          PID:5200
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gyIEEkkU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe""
                                                          8⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2548
                                                          • C:\Windows\SysWOW64\cscript.exe
                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                            9⤵
                                                              PID:4212
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                        6⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Modifies registry key
                                                        PID:4168
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                        6⤵
                                                        • Modifies registry key
                                                        PID:3804
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                        6⤵
                                                        • UAC bypass
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry key
                                                        PID:2952
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MMkUQwww.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe""
                                                        6⤵
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:436
                                                        • C:\Windows\SysWOW64\cscript.exe
                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                          7⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:5100
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                    4⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry key
                                                    PID:5752
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                    4⤵
                                                    • Modifies registry key
                                                    PID:2148
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                    4⤵
                                                    • UAC bypass
                                                    • Modifies registry key
                                                    PID:4992
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gYMwwMMs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe""
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4932
                                                    • C:\Windows\SysWOW64\cscript.exe
                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                      5⤵
                                                        PID:5124
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                  2⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry key
                                                  PID:1836
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                  2⤵
                                                  • Modifies registry key
                                                  PID:1532
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                  2⤵
                                                  • UAC bypass
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry key
                                                  PID:5972
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jcoookAM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock.exe""
                                                  2⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2708
                                                  • C:\Windows\SysWOW64\cscript.exe
                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5964
                                              • C:\ProgramData\ZeoYIQsA\FKUUAQQA.exe
                                                C:\ProgramData\ZeoYIQsA\FKUUAQQA.exe
                                                1⤵
                                                • Executes dropped EXE
                                                • Adds Run key to start application
                                                • Drops file in System32 directory
                                                PID:2936
                                              • C:\Users\Admin\ZAEIYUcY\MUMUwYYc.exe
                                                C:\Users\Admin\ZAEIYUcY\MUMUwYYc.exe
                                                1⤵
                                                • Executes dropped EXE
                                                • Adds Run key to start application
                                                PID:1540
                                              • C:\ProgramData\TCEQkEcE\XSUIcgYs.exe
                                                C:\ProgramData\TCEQkEcE\XSUIcgYs.exe
                                                1⤵
                                                • Executes dropped EXE
                                                • Adds Run key to start application
                                                • Suspicious use of FindShellTrayWindow
                                                PID:3692

                                              Network

                                                    MITRE ATT&CK Enterprise v16

                                                    Reconnaissance

                                                    Resource Development

                                                    Initial Access

                                                    Execution

                                                    Persistence

                                                    Boot or Logon Autostart Execution

                                                    1
                                                    T1547

                                                    Registry Run Keys / Startup Folder

                                                    1
                                                    T1547.001

                                                    Privilege Escalation

                                                    Abuse Elevation Control Mechanism

                                                    1
                                                    T1548

                                                    Bypass User Account Control

                                                    1
                                                    T1548.002

                                                    Boot or Logon Autostart Execution

                                                    1
                                                    T1547

                                                    Registry Run Keys / Startup Folder

                                                    1
                                                    T1547.001

                                                    Defense Evasion

                                                    Abuse Elevation Control Mechanism

                                                    1
                                                    T1548

                                                    Bypass User Account Control

                                                    1
                                                    T1548.002

                                                    Hide Artifacts

                                                    1
                                                    T1564

                                                    Hidden Files and Directories

                                                    1
                                                    T1564.001

                                                    Impair Defenses

                                                    1
                                                    T1562

                                                    Disable or Modify Tools

                                                    1
                                                    T1562.001

                                                    Modify Registry

                                                    4
                                                    T1112

                                                    Credential Access

                                                    Credentials from Password Stores

                                                    1
                                                    T1555

                                                    Credentials from Web Browsers

                                                    1
                                                    T1555.003

                                                    Unsecured Credentials

                                                    1
                                                    T1552

                                                    Credentials In Files

                                                    1
                                                    T1552.001

                                                    Discovery

                                                    System Information Discovery

                                                    1
                                                    T1082

                                                    System Location Discovery

                                                    1
                                                    T1614

                                                    System Language Discovery

                                                    1
                                                    T1614.001

                                                    Lateral Movement

                                                    Collection

                                                    Data from Local System

                                                    1
                                                    T1005

                                                    Command and Control

                                                    Exfiltration

                                                    Impact

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    SAkc.txt
                                                    • Path C:\ProgramData\SAkc.txt
                                                    • Size 9KB
                                                    • SHA256 cdba811bb5ef7f92177cccf22e3f2ce57adc052d1371d7eb49a60c20815e0964
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    XSUIcgYs.exe
                                                    • Path C:\ProgramData\TCEQkEcE\XSUIcgYs.exe
                                                    • Size 1.6MB
                                                    • SHA256 01fb6f103acf011ec1c6c501c630e16d9979db6de4206ecbb3ec462db158db1f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    XSUIcgYs.inf
                                                    • Path C:\ProgramData\TCEQkEcE\XSUIcgYs.inf
                                                    • Size 4B
                                                    • SHA256 77f0957505e7f93036bec25e904b4379e1d4bbfda834c9f93552f8a4731cea91
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    XSUIcgYs.inf
                                                    • Path C:\ProgramData\TCEQkEcE\XSUIcgYs.inf
                                                    • Size 4B
                                                    • SHA256 aef6a7cca3a12cf117c61ca1a4b0d4342b92b8c103891a9691ce9674fe746934
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    XSUIcgYs.inf
                                                    • Path C:\ProgramData\TCEQkEcE\XSUIcgYs.inf
                                                    • Size 4B
                                                    • SHA256 cdd58f2eb1cd41a07c5f42ba101c66c625c27324a847193ca56a1453f20898b0
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    XSUIcgYs.inf
                                                    • Path C:\ProgramData\TCEQkEcE\XSUIcgYs.inf
                                                    • Size 4B
                                                    • SHA256 b04c9a774e20bb4cc609e04ec5e9778e7b905eb54350a9740a98bc62ac8166e4
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    XSUIcgYs.inf
                                                    • Path C:\ProgramData\TCEQkEcE\XSUIcgYs.inf
                                                    • Size 4B
                                                    • SHA256 f682a6f77bfce57f71b12dffb4c9200eaf322c5811c5cdcb8527eda89fab3440
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    FKUUAQQA.exe
                                                    • Path C:\ProgramData\ZeoYIQsA\FKUUAQQA.exe
                                                    • Size 1.6MB
                                                    • SHA256 1eae16c06489da8b0deec235430d9a17510e791bbd34669d2cb4735008ba479f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock
                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-06-27_26872d73d98e88547fb545051527790b_elex_virlock
                                                    • Size 7KB
                                                    • SHA256 24fb7d9728b7167abd93e388017091491fe1df0f05a02e937ec92e1b485d99e3
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    AEAM.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\AEAM.exe
                                                    • Size 1.8MB
                                                    • SHA256 cd9f297c1ca2c24f5512d0c9d3d3becef38a6eeb2f17ab00d4dfa2c60dab57de
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    AEEq.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\AEEq.exe
                                                    • Size 2.4MB
                                                    • SHA256 630820819cf302cb37d131d0ae3e0799ad2c1cedde0eda7568b2c70d51edab7e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    AQki.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\AQki.exe
                                                    • Size 1.6MB
                                                    • SHA256 ff59091d86ffa4fe98fa5eb53f00f0684796f866c94c92ec778fb1f63636e51a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Asgg.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Asgg.exe
                                                    • Size 2.2MB
                                                    • SHA256 b79a0c1ab68080c5940e159242d97a9cb4b94c22970b391966820e501ccdcdf3
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    CAoU.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\CAoU.exe
                                                    • Size 1.6MB
                                                    • SHA256 1d9989acbcfbfb119aad68f884c33d57de1417e74ca9c3c37027cbf0fc19c0d8
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    CEIe.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\CEIe.exe
                                                    • Size 1.8MB
                                                    • SHA256 a97ad0d9b6944f1046e6e6ab33a1284d29338df2bface78ec80221909800d365
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    CEci.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\CEci.exe
                                                    • Size 1.6MB
                                                    • SHA256 1369c9aa29dfac4b8a45ab9645433b4b7ff15731734c819fd305112d55f51080
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    CYAK.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\CYAK.exe
                                                    • Size 2.1MB
                                                    • SHA256 4369025053dd3067ff4c6524271653afd16b5a6c99244c79e64d5ae44e991087
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    EMcm.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\EMcm.exe
                                                    • Size 1.6MB
                                                    • SHA256 ac2a098df7565e4b32e3ccad85f419744657aad40d0f7bdd5590371d0947b0e6
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    EMkS.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\EMkS.exe
                                                    • Size 1.6MB
                                                    • SHA256 6d9a1001477193a727198c25582149a2b2ae54e04bc7b014b5fd673fbc555c09
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    EMwQ.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\EMwQ.exe
                                                    • Size 1.8MB
                                                    • SHA256 488bdb31f25c2bd7e1b772bfe9108bc13c224c41210c5b853ad36eebd6d3b386
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    EwMW.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\EwMW.exe
                                                    • Size 2.2MB
                                                    • SHA256 f87eb929569db1a70ac528fff3ebb1c968356436737b8e972a913a826d83d965
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    GAAQ.ico
                                                    • Path C:\Users\Admin\AppData\Local\Temp\GAAQ.ico
                                                    • Size 4KB
                                                    • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    GQYo.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\GQYo.exe
                                                    • Size 2.1MB
                                                    • SHA256 a02e5e4aece3a13fc288e267ceddf51c16f967ac0db3e6771b7c18db7c49e17a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    GcQi.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\GcQi.exe
                                                    • Size 1.6MB
                                                    • SHA256 77a98cb5c20e1f95800d3f7ba5726e285d28ce8fc9ce06e2379060d95979e242
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    GsAi.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\GsAi.exe
                                                    • Size 2.8MB
                                                    • SHA256 89ae71b6d22b47d83d82f79dd3f5f261e141fe06a6ac41d4fa962cd38343b2ed
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    IEgc.ico
                                                    • Path C:\Users\Admin\AppData\Local\Temp\IEgc.ico
                                                    • Size 4KB
                                                    • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    IIYK.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\IIYK.exe
                                                    • Size 2.0MB
                                                    • SHA256 eb3cae6ab6aef74a79426e6198832892d93706653a736b812bc9da287a7c1fd6
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    IUIq.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\IUIq.exe
                                                    • Size 1.6MB
                                                    • SHA256 c5b5c81a1da4209bd96d545679c838ac325d5f564d9791c5f48b425de4549b4c
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    IUsO.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\IUsO.exe
                                                    • Size 1.9MB
                                                    • SHA256 6548c6d88409ff3b99431dcd6a19b3b1ef72a762574144f90f7f9d9df641cb6d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Ikkq.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Ikkq.exe
                                                    • Size 1.8MB
                                                    • SHA256 7d75556dc270e580ae81490f905d9cd8acb93d23005751a4e83a73d23a7ddf39
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Iswu.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Iswu.exe
                                                    • Size 2.0MB
                                                    • SHA256 ffdb4cde8ea0b57f88857e5b01f78eefdefdb42fbede96bcf368a75289c2c630
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    KMQC.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\KMQC.exe
                                                    • Size 1.7MB
                                                    • SHA256 38e01a23f754e5436535e488eeeb50b0af10d30660781bea1e9d371006782473
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    KMoc.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\KMoc.exe
                                                    • Size 1.6MB
                                                    • SHA256 4f1c2f581bee92ac96957ed23aab56db2e582d78385da356d1e3b4711f205cdb
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    KYEa.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\KYEa.exe
                                                    • Size 1.8MB
                                                    • SHA256 5a0b27d7c5b3e5a1c5168fae5406426d46969ff661743cb6c22a4f51f6754157
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    KYYq.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\KYYq.exe
                                                    • Size 1.8MB
                                                    • SHA256 7312b9b6903e6761acc9c8bdad1202ad758da60f878ba3911b04892b1e552503
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    KcEg.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\KcEg.exe
                                                    • Size 1.9MB
                                                    • SHA256 63873b335ed3fb17bcf186e2de1a9d93d7ca15f12a94d8d841b15499947bb1d7
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    MkQS.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\MkQS.exe
                                                    • Size 1.9MB
                                                    • SHA256 64215c274bb757e9c596b5cf49e315d951aa86b5f02e8cac948c3d74f4662902
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    MsYg.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\MsYg.exe
                                                    • Size 1.7MB
                                                    • SHA256 13d16af7bf73eb13f3ff946304dc84f9095ba0fa248d2bb26638361c8b749130
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    OCUs.ico
                                                    • Path C:\Users\Admin\AppData\Local\Temp\OCUs.ico
                                                    • Size 4KB
                                                    • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    OEoe.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\OEoe.exe
                                                    • Size 1.6MB
                                                    • SHA256 2a0486813fc3315b6c592dd500f7a60b6d574aa4e663d710bb0eceb51177e590
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    OUsu.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\OUsu.exe
                                                    • Size 2.1MB
                                                    • SHA256 92b180914bd126cb4064c6569a552a314395a9225fd3a1d2999e46d920c41d45
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    OcsG.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\OcsG.exe
                                                    • Size 2.0MB
                                                    • SHA256 a3eb44e96ea618654b2ff92972e9a62b13bedcabbee3b955bd3be60eed2dfc2f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Ogki.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Ogki.exe
                                                    • Size 1.6MB
                                                    • SHA256 bf3a1db305301bf063b8f9adb5baafaf9f32c09c0e70096a5028c5858f2e5327
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    OgsG.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\OgsG.exe
                                                    • Size 1.6MB
                                                    • SHA256 49beee251835e97fb2d658153a776fb954290e93a70418f9ea923f8b74d04f94
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    OioU.ico
                                                    • Path C:\Users\Admin\AppData\Local\Temp\OioU.ico
                                                    • Size 4KB
                                                    • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    OsQI.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\OsQI.exe
                                                    • Size 2.4MB
                                                    • SHA256 e97948285a4e0d52946c3fbf463323b79cefd8aa3eaeb2a88048b3c6d781c339
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    QAQE.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\QAQE.exe
                                                    • Size 1.8MB
                                                    • SHA256 7baad01bfc31ca420938c980917bde94c47b64483d937b3aa2ed5fee3706b469
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    QQIa.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\QQIa.exe
                                                    • Size 1.6MB
                                                    • SHA256 0bb5e520fba8888b0a18ffb4bc7f0238cfea4343f46b39cca4333916633387cd
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    QQYk.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\QQYk.exe
                                                    • Size 1.8MB
                                                    • SHA256 050b0a083802586b8724389dd31cddb0204aecbe5a3c6ec7a296dc02b44b2493
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    QUYO.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\QUYO.exe
                                                    • Size 1.6MB
                                                    • SHA256 fc711d673416407f7aeafa7f7ec493453e9b73e2da380c5c22fe33b03e23f68e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Qckq.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Qckq.exe
                                                    • Size 1.7MB
                                                    • SHA256 55f2c7e48fb80bb931b8ce7636f64964a542211386a331d5a82a1a7be4aa555e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Qwsw.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Qwsw.exe
                                                    • Size 2.2MB
                                                    • SHA256 0c0ae9da93c6ee09f2facba1aa479896df6807ce899f382b6e4d1e8d23a7b12f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    SIYe.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\SIYe.exe
                                                    • Size 1.6MB
                                                    • SHA256 b7c5e32ddc03b072fa7b2b973c43cd40bcf55dd02a76c182eb26b84fa391d49e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    SQwQ.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\SQwQ.exe
                                                    • Size 1.8MB
                                                    • SHA256 98338947f126aa942dc7c94199c33f2d381b32a3cf8099a8816e035539330b69
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    SYgU.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\SYgU.exe
                                                    • Size 1.6MB
                                                    • SHA256 2af147f384b6841a471ead78500f7542d5ebeec666abc072b7d4a9fb8df65225
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    SYwW.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\SYwW.exe
                                                    • Size 1.6MB
                                                    • SHA256 40f41d759b0b4df8993def94541d0d91806af8f41edacf39fc9f493b80b41ecd
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Sogs.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Sogs.exe
                                                    • Size 2.0MB
                                                    • SHA256 6494e296aa733fddbf20ad08439d463f771163f21ed5d0debdc0893603688c25
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    SosQ.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\SosQ.exe
                                                    • Size 1.9MB
                                                    • SHA256 99d397af741a62d1d06b5d53b738a538de3907edc5f292ce92525ea32d5f0fba
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Sowm.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Sowm.exe
                                                    • Size 1.6MB
                                                    • SHA256 8daf6be0e0304f03ba6d4e1e6e14de1ebeda39725b54fdb4b566c1eabde1495a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    SsYM.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\SsYM.exe
                                                    • Size 1.6MB
                                                    • SHA256 284c0f363efb96f8012052d4f794016dd25a81fecc25e95594d488697a9d889f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    SwkC.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\SwkC.exe
                                                    • Size 2.3MB
                                                    • SHA256 ca9b38ed669c038b4af9c03552378597be3d37a4473a8efaed15dce86e223db0
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    UEUa.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\UEUa.exe
                                                    • Size 1.6MB
                                                    • SHA256 8e9118a1cc5096fe57053bf002534a74b71b57b69b1d2e73392f932e3533403c
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    UMkU.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\UMkU.exe
                                                    • Size 1.6MB
                                                    • SHA256 0dd4fe181ff09f9375a8ae578788dd32a85dc470ac13c719fee07d72b02c0b83
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    UMwe.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\UMwe.exe
                                                    • Size 1.8MB
                                                    • SHA256 12fb0b6c5d42fcc21ea9d9cdf161da83e21eb76ca1a271e5877b67a835118dff
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    UQIU.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\UQIU.exe
                                                    • Size 1.8MB
                                                    • SHA256 59090ae41264504c053fba72f2258665dcbfb6c1ac9a9746b51d3e7b2f699118
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    UQMQ.ico
                                                    • Path C:\Users\Admin\AppData\Local\Temp\UQMQ.ico
                                                    • Size 4KB
                                                    • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    UcUm.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\UcUm.exe
                                                    • Size 2.0MB
                                                    • SHA256 3546698a38dc4607b71f9ad9cc60cf6eada5b832931bb73a1361d7d5f5bc70d7
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    UgMQ.ico
                                                    • Path C:\Users\Admin\AppData\Local\Temp\UgMQ.ico
                                                    • Size 4KB
                                                    • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Ugou.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Ugou.exe
                                                    • Size 2.3MB
                                                    • SHA256 570c17382796d96e31bccf76825545e6b504d5db54a74d4c7e232fd28eaa221b
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Uooq.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Uooq.exe
                                                    • Size 2.1MB
                                                    • SHA256 23e14c5307ade41da672557085b26f3bb676e08d0bdfc4ef95bed5c3543c8c76
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    UsYM.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\UsYM.exe
                                                    • Size 1.6MB
                                                    • SHA256 31f6fbe813f88023b1ca0dcb4a7ad0dcc80b7ce7100401d5805435e015c9852d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    WAEy.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\WAEy.exe
                                                    • Size 1.8MB
                                                    • SHA256 6b63834a70764033d90f013dbf214a27a169b6fac7ad0e1ec8bb2358dbc54386
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    WEQo.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\WEQo.exe
                                                    • Size 1.8MB
                                                    • SHA256 01a881368fd6526e03284e6606685fbd63b6dbaa26212413b6a0f3e02af2575b
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    WIIA.ico
                                                    • Path C:\Users\Admin\AppData\Local\Temp\WIIA.ico
                                                    • Size 4KB
                                                    • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    WUcs.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\WUcs.exe
                                                    • Size 2.2MB
                                                    • SHA256 11efe0bb9bc4fe82b445695580e3ca53adcb2331efedde1365d4ab5845fd4008
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    WgQS.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\WgQS.exe
                                                    • Size 2.3MB
                                                    • SHA256 2d957a328e76f71588d343d62a3d213c3f92908bbb46a230455da39e34e3ac72
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    WgkG.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\WgkG.exe
                                                    • Size 2.0MB
                                                    • SHA256 a6468665d48321880926f84bcd374c1fd6aa523e3d1dfd68e98e8a0cf7aeeb43
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    WkUo.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\WkUo.exe
                                                    • Size 2.0MB
                                                    • SHA256 4bfbb236ee7a601054946459a4085f7926ac621a58e779d86f8c21f947a9e294
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    WoMy.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\WoMy.exe
                                                    • Size 1.7MB
                                                    • SHA256 539cbf19b33aced45fe2d738f9660a4d455290caa4885123392c2e4a8bcf3349
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Wwoy.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Wwoy.exe
                                                    • Size 2.0MB
                                                    • SHA256 d6e24c23b2a350b4de4187dc6eae69a986046d90ceacdceefb9f258ac21d3eca
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    YQoc.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\YQoc.exe
                                                    • Size 2.1MB
                                                    • SHA256 b064ff65adb65723844e0a3d4100d740b5389ef1833431d3f0f792fd09bf67ab
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    YUgm.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\YUgm.exe
                                                    • Size 1.8MB
                                                    • SHA256 37bc4d32d31f2149475d624b5a962e8fe1a0ae3251a7195c594ea098f8d21aa7
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    YegI.ico
                                                    • Path C:\Users\Admin\AppData\Local\Temp\YegI.ico
                                                    • Size 4KB
                                                    • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    YgQe.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\YgQe.exe
                                                    • Size 2.2MB
                                                    • SHA256 c700d8778d8888690f593584b008459f1c033a81a38af3012882e08204741df0
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    YkgO.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\YkgO.exe
                                                    • Size 2.0MB
                                                    • SHA256 16a503712098106087330a5bea2bd66334fd281a4163f70d1f6f1a101d9d5a00
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Ysgc.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\Ysgc.exe
                                                    • Size 1.8MB
                                                    • SHA256 015934a99fe4b69af86adcc4557efc060a52c88215dc9f7375abc26d8658625b
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    YwYM.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\YwYM.exe
                                                    • Size 1.6MB
                                                    • SHA256 8defa648be49454f2c353a1d46ef84cda0a7cdbf9f69e12086fdf761935806e9
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    agYe.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\agYe.exe
                                                    • Size 1.8MB
                                                    • SHA256 d340f1d486d1e66edcd148b70c01aba4114ffe3b0e2f0bacee9247301b4ca304
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    aoYC.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\aoYC.exe
                                                    • Size 2.2MB
                                                    • SHA256 c9ab6859825c4f910b3a53eeede82bce967a561fcbc303392befe9039cea29fd
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    awAq.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\awAq.exe
                                                    • Size 1.6MB
                                                    • SHA256 28807cada1a84fc2a17ead42b550421f0092784365fceb9600b8969d3ad5f055
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    awYG.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\awYG.exe
                                                    • Size 1.8MB
                                                    • SHA256 6e683bfd08d683522e26ab2ce0740bf2d894cb180010166840eb93bcb2134bdd
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    cAMG.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\cAMG.exe
                                                    • Size 1.6MB
                                                    • SHA256 ea8bffd7613bbae9c5379dbc3e4879aef0adbf22fc81e5f33b898e2454d27c76
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    cAge.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\cAge.exe
                                                    • Size 1.7MB
                                                    • SHA256 64906c146a4177aa2dff3e6b6acfea414413d9b49b1c192a94605e0710b00360
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    cEcG.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\cEcG.exe
                                                    • Size 2.2MB
                                                    • SHA256 9752bb6b03e76b1f62b82d7324cd0985515838c8b569a790589e052bd7a5431e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    cQww.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\cQww.exe
                                                    • Size 2.2MB
                                                    • SHA256 44fcb2b5f038c04178039ac37c9af939eb3a8752498f654604290677994f7357
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    csYM.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\csYM.exe
                                                    • Size 2.1MB
                                                    • SHA256 7899ea3c79d2b914d6468d9ff25025857ef2ed11edcdedf06e73b20dbe771f61
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    csck.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\csck.exe
                                                    • Size 2.0MB
                                                    • SHA256 3521ded6dae69a8f2c97f83d2c1e22c88d82d301e3cb92866445328be595c0a9
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    eUku.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\eUku.exe
                                                    • Size 2.3MB
                                                    • SHA256 5ae57b1f4ffe078c93bf0e4621ecd1eec2867bccdc74f352d97e7068b5553d7b
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ecwE.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\ecwE.exe
                                                    • Size 1.7MB
                                                    • SHA256 b07bfa66ca2f3247282950bf8c04d9dfd36fd73a54b1b458e37254706225ecee
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ekwC.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\ekwC.exe
                                                    • Size 3.1MB
                                                    • SHA256 d9b7d56313038a165fe70f7c1b3abf3c15cdac81374cca9e41c71a0f24dab53e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    file.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                    • Size 19B
                                                    • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    gYEI.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\gYEI.exe
                                                    • Size 2.2MB
                                                    • SHA256 80c584e7c3ae5651490b33f311caac0fbb5224a3125f82f8edab9910430fdb3b
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    gYMe.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\gYMe.exe
                                                    • Size 2.0MB
                                                    • SHA256 fae151d4adc1d1b4f753f52c8f21dfd94803d5e899fb56aa1c02ce11ae364905
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    gYwa.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\gYwa.exe
                                                    • Size 1.9MB
                                                    • SHA256 24ca40e624835803572205ceff2fbc23626879a16b4d43ab63df3da256eed536
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ggYi.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\ggYi.exe
                                                    • Size 1.6MB
                                                    • SHA256 5a5b995002603c2073eaaaa271d24ef92483c0840d041092e0d829db8bba5fe2
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    gwoW.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\gwoW.exe
                                                    • Size 2.4MB
                                                    • SHA256 427d13ed9fb327be1c96c657dbaa341732ca10715cd026bce406c26d0e6d764f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    gwsS.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\gwsS.exe
                                                    • Size 1.8MB
                                                    • SHA256 a091243e50b81b031609c2cb7f39ea3f43e723674eed3694d52644e775fc64b4
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    iIUW.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\iIUW.exe
                                                    • Size 1.6MB
                                                    • SHA256 158916036088d69b4e407a2122403a1153c2c50f6a3c0d50786a604065f5d27e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ioQS.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\ioQS.exe
                                                    • Size 2.2MB
                                                    • SHA256 44eb244ca65e43ce793d53d913d0556ba0855eeece89f16117fd072b5770c8f5
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    jcoookAM.bat
                                                    • Path C:\Users\Admin\AppData\Local\Temp\jcoookAM.bat
                                                    • Size 112B
                                                    • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    kAEY.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\kAEY.exe
                                                    • Size 2.0MB
                                                    • SHA256 0cb3049660b31cb204d2a2a1096d56a35e42baeb5f90d3cecc1ac89ea2969d04
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    kgkI.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\kgkI.exe
                                                    • Size 1.9MB
                                                    • SHA256 7fdd5730ed5915a691adf1e464ec3429f180609f352f8a355a5626b62efdcc1e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    kowO.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\kowO.exe
                                                    • Size 1.9MB
                                                    • SHA256 49628be7561e992f1895b9b5879b0ede607c584f92b808a7b0a338da34968e27
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    kwIO.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\kwIO.exe
                                                    • Size 1.6MB
                                                    • SHA256 3fb491216bc368cb3139d0ab991138dfe1890063c89bb45755a41ca2cdebaf86
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    mUUm.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\mUUm.exe
                                                    • Size 1.6MB
                                                    • SHA256 9b245660008fae2aa5b68e49cb0177a55dcbd11b9877165a7eed825c8ecb52ef
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    mYgC.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\mYgC.exe
                                                    • Size 1.6MB
                                                    • SHA256 ac88e999fc08dd858aad3ba5ee1d424c030c58e216f3879f2956ec88cdb38e98
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    mcMM.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\mcMM.exe
                                                    • Size 2.2MB
                                                    • SHA256 6066bf82e002c537caba9ae09b4025668b64b472d4a6aa596db4c5b5790b8254
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    oIEW.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\oIEW.exe
                                                    • Size 2.2MB
                                                    • SHA256 1bb5c60087fe6e92da9347f84d0387e7aa0f38a768a4190f38c194b3d2fb422d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    oQsy.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\oQsy.exe
                                                    • Size 1.9MB
                                                    • SHA256 9747fad0f1fef3637106cfd47d107bdbffb39385988e7c671a1e4eb4f81a3ad5
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    oYYk.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\oYYk.exe
                                                    • Size 2.3MB
                                                    • SHA256 01eaaf6f9d1eb58a316a5b00bb5ea2413c26f243c13f89ebab1d09586e6f7f74
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ocUW.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\ocUW.exe
                                                    • Size 1.7MB
                                                    • SHA256 37dba8af0ed6361e863c619ba0f3b4a2df62ed45063b7c5fed4975d4d84416eb
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    owES.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\owES.exe
                                                    • Size 1.9MB
                                                    • SHA256 e1fd580a2431672770164de6a49e63807d3eb9dc8706723647ba16a4e9013675
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    qMMg.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\qMMg.exe
                                                    • Size 2.8MB
                                                    • SHA256 8a158c5ae897750901bb28a46b0e519ad00a3ad6c1967fcde6050c9e728eac55
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    qQwW.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\qQwW.exe
                                                    • Size 1.9MB
                                                    • SHA256 f78ecd8f0e22728d2fc0aae561d90dae787684727dbd52b8af36cbfbb2205428
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    qYcy.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\qYcy.exe
                                                    • Size 1.6MB
                                                    • SHA256 4cc228e7f3658665fc19f5648b5ed0c80de645cd5e2406ff5c41d5049f465ad6
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    qcEg.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\qcEg.exe
                                                    • Size 1.6MB
                                                    • SHA256 ddad52b21ff367fbe22fce6e9499206cebf9344bc7816ebbf3d54b9d8d4f29fc
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    qcYg.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\qcYg.exe
                                                    • Size 1.7MB
                                                    • SHA256 505daff86e72706b8945887418b1e26616f94f534ffe83e9c5c412eb7c60696c
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    qcwa.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\qcwa.exe
                                                    • Size 1.7MB
                                                    • SHA256 eed321c5857c26fe5e0f3d4fa3832de0f62b4f67b25057e52428ebd419792173
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    qssi.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\qssi.exe
                                                    • Size 2.3MB
                                                    • SHA256 f0c6f51b5157a3f7a0b081ab633cf1d79c4530fbd4ebdfaf3c24016c3e5440ed
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    qwAe.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\qwAe.exe
                                                    • Size 1.6MB
                                                    • SHA256 b872b365ef8b73cda59b8f81a0c9df2fa8a5f404acf6d2e69257e65ef42a6370
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    qwsk.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\qwsk.exe
                                                    • Size 2.1MB
                                                    • SHA256 aebb78f9ec17d4e8ea3a1f139ba1368f9cbb224c2c04ea9f64a2302ead1752be
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    sUEg.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\sUEg.exe
                                                    • Size 1.9MB
                                                    • SHA256 9a8568700cbf9dc3ecf097b1e569ca9679cb1dbdb4e00d0e16f78c3c067df2ad
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    scws.ico
                                                    • Path C:\Users\Admin\AppData\Local\Temp\scws.ico
                                                    • Size 4KB
                                                    • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    skca.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\skca.exe
                                                    • Size 1.6MB
                                                    • SHA256 a14b2d25c731cb555fb1c5f72f133c251cb71e4cef0e200309d1653763028e00
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    sssg.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\sssg.exe
                                                    • Size 3.1MB
                                                    • SHA256 b31c3ca6fdafd2b5dfee5e65f0bcf88766fb6d70249d07025cfcd78d62f488ae
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    uAAc.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\uAAc.exe
                                                    • Size 2.0MB
                                                    • SHA256 bc0f30fbfab4e4b4680b24c372d3b00dd2813de39523b7fd3d7ff350ee9b8b9b
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    uAYI.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\uAYI.exe
                                                    • Size 2.2MB
                                                    • SHA256 078790874897253aa6ec3106a442f02e99e9315717ce001095e8a328f39134d1
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    uKMI.ico
                                                    • Path C:\Users\Admin\AppData\Local\Temp\uKMI.ico
                                                    • Size 4KB
                                                    • SHA256 114dae4c54ca426f78e50998727dac92942261d71ca5b2dbaf413794dcf8ad82
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ucAO.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\ucAO.exe
                                                    • Size 1.6MB
                                                    • SHA256 ae9065f1bb3fb441b60ebf1d79b020fe2049d0c00cc771743fc8f63457e90768
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ugMM.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\ugMM.exe
                                                    • Size 2.0MB
                                                    • SHA256 56b3554b74341ac388613c57b2799bb7118aa68fffddab9b4e09c51b0d598b06
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ugsw.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\ugsw.exe
                                                    • Size 2.7MB
                                                    • SHA256 bb8e5c31eb43fd6e40d40cdf08fe204980d62a2a2a7225a5465048ee019bdcf6
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    uoUs.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\uoUs.exe
                                                    • Size 1.6MB
                                                    • SHA256 2fb860ba2b8a82fd0642e0d4df26b641af9e4f8b3e4542c1f9f04bf19fd1fc18
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    wgwo.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\wgwo.exe
                                                    • Size 2.0MB
                                                    • SHA256 0107b27b89ae0025d0e3dfe9e9e0558a8c22a957db8637411ee4bd7a7e607c12
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    yEIe.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\yEIe.exe
                                                    • Size 2.3MB
                                                    • SHA256 bb129e91eab1e81692c0caac411e34261aa57747df0a2a6b886b45ebd808a192
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    yEgI.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\yEgI.exe
                                                    • Size 2.5MB
                                                    • SHA256 ed96b8b3eeae63d8bffe21d432748b1c6823d394ab96009f795cfce0aabdb1f0
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    yogM.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\yogM.exe
                                                    • Size 1.6MB
                                                    • SHA256 a39e4aacfd769c77fa892d10070c66793bdc0e438e4a5570a2cbac30a6d53c43
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    yskG.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\yskG.exe
                                                    • Size 1.6MB
                                                    • SHA256 8c1b96153c255e6649bd75508d04329d7af7724f8b85943264d45e8d378c83ef
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    MUMUwYYc.exe
                                                    • Path C:\Users\Admin\ZAEIYUcY\MUMUwYYc.exe
                                                    • Size 1.6MB
                                                    • SHA256 9c74137e9bc0327527859786530efe8168d8113ce2d4df5371ee4cc15134e0ca
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    MUMUwYYc.inf
                                                    • Path C:\Users\Admin\ZAEIYUcY\MUMUwYYc.inf
                                                    • Size 4B
                                                    • SHA256 6e8abf4e40a32243e9815251e8748b6325026c122f1f94296191d0451c116b25
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    memory/828-230-0x0000000000400000-0x0000000000594000-memory.dmp
                                                    Download

                                                    memory/1208-51-0x0000000000400000-0x0000000000594000-memory.dmp
                                                    Download

                                                    memory/1236-110-0x0000000000400000-0x0000000000594000-memory.dmp
                                                    Download

                                                    memory/1464-14-0x0000000000400000-0x0000000000591000-memory.dmp
                                                    Download

                                                    memory/1464-1927-0x0000000000400000-0x0000000000591000-memory.dmp
                                                    Download

                                                    memory/1540-1937-0x0000000000400000-0x0000000000590000-memory.dmp
                                                    Download

                                                    memory/1780-96-0x0000000000400000-0x0000000000594000-memory.dmp
                                                    Download

                                                    memory/1820-126-0x0000000000400000-0x0000000000594000-memory.dmp
                                                    Download

                                                    memory/2936-21-0x0000000000400000-0x0000000000590000-memory.dmp
                                                    Download

                                                    memory/2936-1932-0x0000000000400000-0x0000000000590000-memory.dmp
                                                    Download

                                                    memory/2960-66-0x0000000000400000-0x0000000000594000-memory.dmp
                                                    Download

                                                    memory/2960-47-0x0000000000400000-0x0000000000594000-memory.dmp
                                                    Download

                                                    memory/3284-171-0x0000000000400000-0x0000000000594000-memory.dmp
                                                    Download

                                                    memory/3524-1733-0x00000000021F0000-0x0000000002210000-memory.dmp
                                                    Download

                                                    memory/3524-7-0x0000000000400000-0x0000000000590000-memory.dmp
                                                    Download

                                                    memory/3524-1922-0x0000000000400000-0x0000000000590000-memory.dmp
                                                    Download

                                                    memory/3524-272-0x00000000021F0000-0x0000000002210000-memory.dmp
                                                    Download

                                                    memory/3692-1942-0x0000000000400000-0x0000000000591000-memory.dmp
                                                    Download

                                                    memory/3712-1-0x00000000021F0000-0x0000000002210000-memory.dmp
                                                    Download

                                                    memory/3712-0-0x0000000000400000-0x0000000000594000-memory.dmp
                                                    Download

                                                    memory/3712-32-0x0000000000400000-0x0000000000594000-memory.dmp
                                                    Download

                                                    memory/3712-33-0x00000000021F0000-0x0000000002210000-memory.dmp
                                                    Download

                                                    memory/4092-251-0x0000000000400000-0x0000000000594000-memory.dmp
                                                    Download

                                                    memory/4156-260-0x0000000000400000-0x0000000000594000-memory.dmp
                                                    Download

                                                    memory/4200-167-0x0000000000400000-0x0000000000594000-memory.dmp
                                                    Download

                                                    memory/4200-186-0x0000000000400000-0x0000000000594000-memory.dmp
                                                    Download

                                                    memory/4696-218-0x0000000000400000-0x0000000000594000-memory.dmp
                                                    Download

                                                    memory/4748-187-0x0000000000400000-0x0000000000594000-memory.dmp
                                                    Download

                                                    memory/4748-201-0x0000000000400000-0x0000000000594000-memory.dmp
                                                    Download

                                                    memory/4780-154-0x0000000000400000-0x0000000000594000-memory.dmp
                                                    Download

                                                    memory/5440-82-0x0000000000400000-0x0000000000594000-memory.dmp
                                                    Download

                                                    memory/6072-140-0x0000000000400000-0x0000000000594000-memory.dmp
                                                    Download

                                                    memory/6136-240-0x0000000000400000-0x0000000000594000-memory.dmp
                                                    Download