Overview

overview

10

Static

static

3

2026-07-11...ck.exe

windows10-2004-x64

10

2026-07-11...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/07/2026, 03:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe
  • Size 1.6MB
  • Sample260711-dkcd6say7p
  • SHA256 ea030fde5012bb4e74b580792312489cc5779ab34068ee64813eb0d5ee66ae86
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverynabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 18 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 18 IoCs
    defense_evasiontrojan
  • Renames multiple (109) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 54 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4960
    • C:\Users\Admin\hUUUskAA\QeUAowkE.exe
      "C:\Users\Admin\hUUUskAA\QeUAowkE.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      PID:4076
    • C:\ProgramData\PgoYgwgo\HKgcAsgw.exe
      "C:\ProgramData\PgoYgwgo\HKgcAsgw.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:3880
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2368
      • C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5588
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6088
          • C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4488
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2348
              • C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2756
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:5512
                  • C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:3124
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock"
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4204
                      • C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:4536
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock"
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:1256
                          • C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock
                            13⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:5436
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock"
                              14⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:5552
                              • C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock
                                15⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:5396
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock"
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:5408
                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:4156
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock"
                                      18⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:5928
                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock
                                        19⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2108
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock"
                                          20⤵
                                            PID:2648
                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe
                                              C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock
                                              21⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:1248
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock"
                                                22⤵
                                                  PID:5988
                                                  • C:\Windows\System32\Conhost.exe
                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    23⤵
                                                      PID:2356
                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe
                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock
                                                      23⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:4800
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock"
                                                        24⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3384
                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe
                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock
                                                          25⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:3388
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock"
                                                            26⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1720
                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe
                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock
                                                              27⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:2384
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock"
                                                                28⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:6084
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock
                                                                  29⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:680
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock"
                                                                    30⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:3020
                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock
                                                                      31⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:4856
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock"
                                                                        32⤵
                                                                          PID:1784
                                                                          • C:\Windows\System32\Conhost.exe
                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                            33⤵
                                                                              PID:5124
                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock
                                                                              33⤵
                                                                                PID:3872
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock"
                                                                                  34⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:2312
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock
                                                                                    35⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:5832
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock"
                                                                                      36⤵
                                                                                        PID:4600
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                        36⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Modifies registry key
                                                                                        PID:4128
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                        36⤵
                                                                                        • Modifies registry key
                                                                                        PID:4996
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                        36⤵
                                                                                        • UAC bypass
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Modifies registry key
                                                                                        PID:3096
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\acEgswUw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe""
                                                                                        36⤵
                                                                                          PID:804
                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                            37⤵
                                                                                              PID:2396
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                        34⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Modifies registry key
                                                                                        PID:5404
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                        34⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Modifies registry key
                                                                                        PID:5152
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                        34⤵
                                                                                        • UAC bypass
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Modifies registry key
                                                                                        PID:552
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GiIEscQs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe""
                                                                                        34⤵
                                                                                          PID:204
                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                            35⤵
                                                                                              PID:1940
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                        32⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        • Modifies registry key
                                                                                        PID:2444
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                        32⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Modifies registry key
                                                                                        PID:3304
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                        32⤵
                                                                                        • UAC bypass
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Modifies registry key
                                                                                        PID:2664
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fuYwcEgQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe""
                                                                                        32⤵
                                                                                          PID:4448
                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                            33⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:4228
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                      30⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      • Modifies registry key
                                                                                      PID:4656
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                      30⤵
                                                                                      • Modifies registry key
                                                                                      PID:2188
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                      30⤵
                                                                                      • UAC bypass
                                                                                      • Modifies registry key
                                                                                      PID:1608
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JIksgMAc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe""
                                                                                      30⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:4160
                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                        31⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2800
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                  28⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • Modifies registry key
                                                                                  PID:5440
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                  28⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Modifies registry key
                                                                                  PID:5468
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                  28⤵
                                                                                  • UAC bypass
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Modifies registry key
                                                                                  PID:1868
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oyEkEsoc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe""
                                                                                  28⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:1916
                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                    29⤵
                                                                                      PID:1080
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                26⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Modifies registry key
                                                                                PID:6092
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                26⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Modifies registry key
                                                                                PID:2024
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                26⤵
                                                                                • UAC bypass
                                                                                • Modifies registry key
                                                                                PID:4788
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UYIoIAgo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe""
                                                                                26⤵
                                                                                  PID:464
                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                    27⤵
                                                                                      PID:4476
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                24⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Modifies registry key
                                                                                PID:3576
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                24⤵
                                                                                • Modifies registry key
                                                                                PID:4288
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                24⤵
                                                                                • UAC bypass
                                                                                • Modifies registry key
                                                                                PID:4268
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\icMoosQE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe""
                                                                                24⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:1400
                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                  25⤵
                                                                                    PID:5792
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                              22⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Modifies registry key
                                                                              PID:4308
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                              22⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies registry key
                                                                              PID:1940
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                              22⤵
                                                                              • UAC bypass
                                                                              • Modifies registry key
                                                                              PID:5892
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LKsIUQEo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe""
                                                                              22⤵
                                                                                PID:3188
                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                  23⤵
                                                                                    PID:5276
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                              20⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Modifies registry key
                                                                              PID:2612
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                              20⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies registry key
                                                                              PID:6052
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                              20⤵
                                                                              • UAC bypass
                                                                              • Modifies registry key
                                                                              PID:4392
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PWsIogIU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe""
                                                                              20⤵
                                                                                PID:1976
                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                  21⤵
                                                                                    PID:1300
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                              18⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies registry key
                                                                              PID:2484
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                              18⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies registry key
                                                                              PID:4936
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                              18⤵
                                                                              • UAC bypass
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies registry key
                                                                              PID:1520
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\paMUcUwA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe""
                                                                              18⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1576
                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                19⤵
                                                                                  PID:4500
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                            16⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Modifies registry key
                                                                            PID:6136
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                            16⤵
                                                                            • Modifies registry key
                                                                            PID:4052
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                            16⤵
                                                                            • UAC bypass
                                                                            • Modifies registry key
                                                                            PID:2064
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OSsIUUUk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe""
                                                                            16⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4652
                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                              17⤵
                                                                                PID:4764
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                          14⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Modifies registry key
                                                                          PID:5460
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                          14⤵
                                                                          • Modifies registry key
                                                                          PID:5376
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                          14⤵
                                                                          • UAC bypass
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Modifies registry key
                                                                          PID:4984
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EAUAkEws.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe""
                                                                          14⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4312
                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                            15⤵
                                                                              PID:2952
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                        12⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Modifies registry key
                                                                        PID:2428
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                        12⤵
                                                                        • Modifies registry key
                                                                        PID:4516
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                        12⤵
                                                                        • UAC bypass
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Modifies registry key
                                                                        PID:708
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GMQUIkQg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe""
                                                                        12⤵
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4584
                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                          13⤵
                                                                            PID:4404
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                      10⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies registry key
                                                                      PID:3748
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                      10⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies registry key
                                                                      PID:5676
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                      10⤵
                                                                      • UAC bypass
                                                                      • Modifies registry key
                                                                      PID:556
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VMoUoMQc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe""
                                                                      10⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5416
                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                        11⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:2516
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                  8⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • Modifies registry key
                                                                  PID:552
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                  8⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry key
                                                                  PID:3520
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                  8⤵
                                                                  • UAC bypass
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry key
                                                                  PID:2356
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\twAcsYMw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe""
                                                                  8⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5576
                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                    9⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:1592
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                              6⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Modifies registry key
                                                              PID:5124
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                              6⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry key
                                                              PID:2192
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                              6⤵
                                                              • UAC bypass
                                                              • Modifies registry key
                                                              PID:992
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GMgsMMQU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe""
                                                              6⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4624
                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                7⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:3532
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                          4⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry key
                                                          PID:4936
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                          4⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry key
                                                          PID:3020
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                          4⤵
                                                          • UAC bypass
                                                          • Modifies registry key
                                                          PID:4928
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UiwEUQwM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe""
                                                          4⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3328
                                                          • C:\Windows\SysWOW64\cscript.exe
                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                            5⤵
                                                              PID:2612
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                        2⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Modifies registry key
                                                        PID:2188
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                        2⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry key
                                                        PID:1608
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                        2⤵
                                                        • UAC bypass
                                                        • Modifies registry key
                                                        PID:4156
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kCsMAAUs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock.exe""
                                                        2⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2768
                                                        • C:\Windows\SysWOW64\cscript.exe
                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                          3⤵
                                                            PID:5424
                                                      • C:\Users\Admin\hUUUskAA\QeUAowkE.exe
                                                        C:\Users\Admin\hUUUskAA\QeUAowkE.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Adds Run key to start application
                                                        PID:4212
                                                      • C:\ProgramData\YMoIYAoA\DswMUAsE.exe
                                                        C:\ProgramData\YMoIYAoA\DswMUAsE.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Adds Run key to start application
                                                        • Drops file in System32 directory
                                                        PID:5140
                                                      • C:\ProgramData\PgoYgwgo\HKgcAsgw.exe
                                                        C:\ProgramData\PgoYgwgo\HKgcAsgw.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Adds Run key to start application
                                                        PID:4360

                                                      Network

                                                            MITRE ATT&CK Enterprise v16

                                                            Reconnaissance

                                                            Resource Development

                                                            Initial Access

                                                            Execution

                                                            Persistence

                                                            Boot or Logon Autostart Execution

                                                            1
                                                            T1547

                                                            Registry Run Keys / Startup Folder

                                                            1
                                                            T1547.001

                                                            Privilege Escalation

                                                            Abuse Elevation Control Mechanism

                                                            1
                                                            T1548

                                                            Bypass User Account Control

                                                            1
                                                            T1548.002

                                                            Boot or Logon Autostart Execution

                                                            1
                                                            T1547

                                                            Registry Run Keys / Startup Folder

                                                            1
                                                            T1547.001

                                                            Defense Evasion

                                                            Abuse Elevation Control Mechanism

                                                            1
                                                            T1548

                                                            Bypass User Account Control

                                                            1
                                                            T1548.002

                                                            Hide Artifacts

                                                            1
                                                            T1564

                                                            Hidden Files and Directories

                                                            1
                                                            T1564.001

                                                            Impair Defenses

                                                            1
                                                            T1562

                                                            Disable or Modify Tools

                                                            1
                                                            T1562.001

                                                            Modify Registry

                                                            4
                                                            T1112

                                                            Credential Access

                                                            Credentials from Password Stores

                                                            1
                                                            T1555

                                                            Credentials from Web Browsers

                                                            1
                                                            T1555.003

                                                            Unsecured Credentials

                                                            1
                                                            T1552

                                                            Credentials In Files

                                                            1
                                                            T1552.001

                                                            Discovery

                                                            System Information Discovery

                                                            1
                                                            T1082

                                                            System Location Discovery

                                                            1
                                                            T1614

                                                            System Language Discovery

                                                            1
                                                            T1614.001

                                                            Lateral Movement

                                                            Collection

                                                            Data from Local System

                                                            1
                                                            T1005

                                                            Command and Control

                                                            Exfiltration

                                                            Impact

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            HKgcAsgw.exe
                                                            • Path C:\ProgramData\PgoYgwgo\HKgcAsgw.exe
                                                            • Size 1.6MB
                                                            • SHA256 50f4b0ad8c8b82880bef1acc3c2c4c7220eab63d472815645835fcac8b6106a2
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            HKgcAsgw.inf
                                                            • Path C:\ProgramData\PgoYgwgo\HKgcAsgw.inf
                                                            • Size 4B
                                                            • SHA256 6415299949cc54707a4b34a977a16ee2c490e9777050d08224288e9104e88c9c
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            DswMUAsE.exe
                                                            • Path C:\ProgramData\YMoIYAoA\DswMUAsE.exe
                                                            • Size 1.6MB
                                                            • SHA256 ecaa79c7424d81bcd6348e898e2f80b4a85427dc11d1776d9007b2f048d87f35
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            aukQ.txt
                                                            • Path C:\ProgramData\aukQ.txt
                                                            • Size 8KB
                                                            • SHA256 c56d839221d79822462865490e9d186577c218389049400db8fee8de12256848
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock
                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-07-11_4e41faf8ad6f225dbb02e3199525c3d6_elex_virlock
                                                            • Size 5KB
                                                            • SHA256 98817a572430813ca4ca2787dab20573f7864c5168ac6912f34d14b49e7bd7c9
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            AQIO.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\AQIO.exe
                                                            • Size 2.2MB
                                                            • SHA256 7d4a2ad5c8d65d3fe2e426dbab16ba131e96a31855abaaf8cc92be107d288ff9
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            AQoc.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\AQoc.exe
                                                            • Size 1.8MB
                                                            • SHA256 688125ab8d287e3b4d12242b0983a51acc3602be703cb5d4a96e169b5cc01a9f
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Aocy.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\Aocy.exe
                                                            • Size 2.2MB
                                                            • SHA256 8bf207baa0a36145a6e1a550f35be62bf6b3b1564ebef2b95d8715a43b5c56d2
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            AooY.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\AooY.exe
                                                            • Size 1.6MB
                                                            • SHA256 239aadd854706020c6172680d02f47697126fdced3312251c99ab0049771d8eb
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            AsQw.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\AsQw.exe
                                                            • Size 2.2MB
                                                            • SHA256 307848ac1e942c5c735898e8c1cd0f50d575e078a67fb3c807173bc590beca4c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            CAkE.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\CAkE.exe
                                                            • Size 1.7MB
                                                            • SHA256 f23498085efc42c67732f014097285b4c331baf6153b9fe6610166f1eefa0001
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            CMAa.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\CMAa.exe
                                                            • Size 1.6MB
                                                            • SHA256 e1cd2a6f982598aad26d8f531ae1eb69ceb4ce310a8097baa4e59650da8bb78b
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            CUcA.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\CUcA.exe
                                                            • Size 2.1MB
                                                            • SHA256 181748f5741144ce616261e8be83696271b9204ae519ca07cf1760189652dabe
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            CYsg.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\CYsg.exe
                                                            • Size 1.6MB
                                                            • SHA256 2ed077a8a17e3fc346ec6f3909a8038993e68f069e041cf0e721e3db98e05333
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            CksW.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\CksW.exe
                                                            • Size 2.3MB
                                                            • SHA256 63e3207d83aa823654d04ebe5557b11a527046959ed0101d8f35f304509676fa
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            CsMQ.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\CsMQ.exe
                                                            • Size 2.2MB
                                                            • SHA256 a3255ea6b908e378c5eac5da7b102f1ad21d685b5da69e1be7f10bcf40762866
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            CwQa.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\CwQa.exe
                                                            • Size 1.6MB
                                                            • SHA256 749bf7dca2ae7afcc2cd8819c41792f4f4430ac0dba78f1d75e9468d1f00d3c5
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            EWoo.ico
                                                            • Path C:\Users\Admin\AppData\Local\Temp\EWoo.ico
                                                            • Size 4KB
                                                            • SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            EcIG.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\EcIG.exe
                                                            • Size 1.9MB
                                                            • SHA256 618c6c03a68e4ed8d1b52c5337cb993bded78fc3473085c0796a3ce506f49586
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            GAAK.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\GAAK.exe
                                                            • Size 1.6MB
                                                            • SHA256 f59cb1f8ad76dd648887d3078f0ad11e32b078966112ecfef0163c6edcee80f5
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            GUsS.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\GUsS.exe
                                                            • Size 1.6MB
                                                            • SHA256 a5ada1a7c3a0542455da3f6ba3065235065d69e3b50d4c6ce643df9e469f3347
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            GecI.ico
                                                            • Path C:\Users\Admin\AppData\Local\Temp\GecI.ico
                                                            • Size 4KB
                                                            • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            IcMU.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\IcMU.exe
                                                            • Size 2.4MB
                                                            • SHA256 7b403920e2c04b71b6237b9989ade12cd76483f31efd207923b97760615c2791
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            IcMa.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\IcMa.exe
                                                            • Size 2.3MB
                                                            • SHA256 9a965fc79957b81c0b66f536e3b9edb496e4ebca31323a26c1c41c4de2ed2f27
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            IcsM.ico
                                                            • Path C:\Users\Admin\AppData\Local\Temp\IcsM.ico
                                                            • Size 4KB
                                                            • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            KAIc.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\KAIc.exe
                                                            • Size 1.6MB
                                                            • SHA256 977f7bac7fcec514722ee2a37d520c462de2734aac31882fe2558275e1554d95
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            KQcc.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\KQcc.exe
                                                            • Size 2.2MB
                                                            • SHA256 8060ee54d0e158ae4c8f366f06063558d79f6aad6709072112b1a274c35b467f
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            KggQ.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\KggQ.exe
                                                            • Size 2.1MB
                                                            • SHA256 01b933b483000671041402c179d87867ea40a17c1c626e59787421267757a30b
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Kgos.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\Kgos.exe
                                                            • Size 2.0MB
                                                            • SHA256 cf486e0e5bd78cd0bb753be40d81d0f707310e5e648f662169a9e38ac1055fd3
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            KwQe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\KwQe.exe
                                                            • Size 2.0MB
                                                            • SHA256 08edfffb66022851d42ff479582b316bfa11e916dcc1456a727e10ac7ebf9dc7
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            KwsG.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\KwsG.exe
                                                            • Size 2.0MB
                                                            • SHA256 3b33ff1e59803d9b33d32444c5f57def911a9be2e149e7bef3b0fbe80dd1b12a
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            MMgU.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\MMgU.exe
                                                            • Size 2.2MB
                                                            • SHA256 0fbd0904f0aafba7fbbe1ffd686a971f67eaef13e3448e48063a03355357fb36
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            MgwQ.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\MgwQ.exe
                                                            • Size 2.2MB
                                                            • SHA256 ce5de12c68542272481407a1d071f328ab2ad3f756b91cc6ab3bc702466cfb14
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            MwIU.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\MwIU.exe
                                                            • Size 2.1MB
                                                            • SHA256 56ce4246c329b8c0150a97851c3f60c770ab4a2a17b035f10ed6e7aa3bda5d2b
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Mwgi.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\Mwgi.exe
                                                            • Size 1.8MB
                                                            • SHA256 d7f81405c5ab55e9053ad9d2a8d70198ac3cedd3b7bde137118f917d4ea0e97a
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            OEwo.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\OEwo.exe
                                                            • Size 2.5MB
                                                            • SHA256 2116814d6a88305f926126214fb0890dd68e5442a817013a6dbed3d6dc8722d6
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            OQEe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\OQEe.exe
                                                            • Size 1.9MB
                                                            • SHA256 8260925fb502b2540fd0de64bd6f38bc2aaf1943b46a9cf28f2bbdb13c3295e3
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            OWMw.ico
                                                            • Path C:\Users\Admin\AppData\Local\Temp\OWMw.ico
                                                            • Size 4KB
                                                            • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            OkAq.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\OkAq.exe
                                                            • Size 2.3MB
                                                            • SHA256 d02dad4f0e86351a404b4686f79ba7dd5421472608b2f085820964f79fe17dc9
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            OksS.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\OksS.exe
                                                            • Size 1.7MB
                                                            • SHA256 95814cf197dec2ff286ad8a1e2034b8296fc4b0d95a4374096dfc62148b93805
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            OsEA.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\OsEA.exe
                                                            • Size 1.8MB
                                                            • SHA256 160a07f5467c4c24390d933a628f70c1b34645a27f18705fe795b32bdffe3e1d
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            QMkk.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\QMkk.exe
                                                            • Size 1.8MB
                                                            • SHA256 cc34d760309342afd56021d755159747d34a7ea949ceca6bbd2633db36439bc6
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            QQsM.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\QQsM.exe
                                                            • Size 1.6MB
                                                            • SHA256 636eaa748a04ea7947fc9813197c5fa495a1de35cbc97b53f64a41cd80f60d90
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            QoIm.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\QoIm.exe
                                                            • Size 1.8MB
                                                            • SHA256 fe4b2cfd07c4337cb0e753757f6e2f39da7a8a12a3322efba0eb00cf603bfef3
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            SAIQ.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\SAIQ.exe
                                                            • Size 1.6MB
                                                            • SHA256 76d382014ee52c4ee669c5d4b0ce00e94b1f0483ade829663f0d24f6aa521029
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            SQIC.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\SQIC.exe
                                                            • Size 1.9MB
                                                            • SHA256 fc0b2055f3a3c3c88086bdeaf0e7ebef6ec52589f1ec53ebaca688948aa13252
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            SskC.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\SskC.exe
                                                            • Size 1.6MB
                                                            • SHA256 f3ef75aeec007c1d02128b0d00a2be281a9e77a748d71a98cc09c0f0565f1faf
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            SsoI.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\SsoI.exe
                                                            • Size 1.6MB
                                                            • SHA256 5d211e94a19bcae7dbaadda0f7497d08b7c9b752b480cc51f0d82bc144aef659
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            UAwC.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\UAwC.exe
                                                            • Size 2.1MB
                                                            • SHA256 83490d48d56753f59c559b1deadbd1f226d09511be6b576126230dd3e9c837fc
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            UgIU.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\UgIU.exe
                                                            • Size 2.0MB
                                                            • SHA256 ac207995c0cbd703b4962ced21ec6b12c252e26f51d1105ac2882cf45ef93dcb
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Wwkk.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\Wwkk.exe
                                                            • Size 1.9MB
                                                            • SHA256 c4886000ae9eaa5c0f7d2cb92cc3a77e18275df5a68a23e6613be489bbd65f71
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            WyEM.ico
                                                            • Path C:\Users\Admin\AppData\Local\Temp\WyEM.ico
                                                            • Size 4KB
                                                            • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            YMcS.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\YMcS.exe
                                                            • Size 1.7MB
                                                            • SHA256 620701cb020363b15489d12de3f90534f1963eda180c0a63b4a3709c3d43964c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            YYoe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\YYoe.exe
                                                            • Size 1.6MB
                                                            • SHA256 1176567f258fb47c0dfaf8c4a7478cab1d4f3bd28432d6c5fe2867f8ed2ff9e5
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            aAQu.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\aAQu.exe
                                                            • Size 2.0MB
                                                            • SHA256 d3d9abab62b81756075ed766bd1187a3750802c6fb4bb863c8c703ba92ddbe8f
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            aEMS.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\aEMS.exe
                                                            • Size 2.0MB
                                                            • SHA256 acc4a90a0c5bf1d114ecd13e0ce336e58df2f5702b17d0e7174fa0c5b6d7a579
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            aEUq.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\aEUq.exe
                                                            • Size 2.2MB
                                                            • SHA256 790e61f9392d0609b27f5fbc0fed9ffd47682da1462c49da856d0956768a2771
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            aYYA.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\aYYA.exe
                                                            • Size 1.8MB
                                                            • SHA256 a7d63c7a0879926328539aa7d6585b8503cc03e8d5097c605062d4ad34cbcc6d
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            aYky.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\aYky.exe
                                                            • Size 2.1MB
                                                            • SHA256 ce923f9c9b3365a6ea275ed265db57ec2da40e974060e8664b57e3d37c92466c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            agMe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\agMe.exe
                                                            • Size 1.6MB
                                                            • SHA256 4f15a1aebc8265822540bae8140478135859e3f0f46c4039783df4855d91327b
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            cEAo.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\cEAo.exe
                                                            • Size 1.8MB
                                                            • SHA256 1cd51dc46b521ccb27328d6e7906f73db4c1c12f14774dd9a122b38da1514849
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            cIQg.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\cIQg.exe
                                                            • Size 1.6MB
                                                            • SHA256 8106ca6f178f30ff307eadd0254b5bf45a2a6e8c665a365020e8c061d98f961a
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            cMsg.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\cMsg.exe
                                                            • Size 2.1MB
                                                            • SHA256 386e53b696093838f16f90ec5229456856d473b4e35bcd72b52f98d432fff966
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            cYcE.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\cYcE.exe
                                                            • Size 2.5MB
                                                            • SHA256 98a0d258ce23279cdf19c891bc8f7d0a6875337260a85aa0f3e02727cde231a8
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            cYkq.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\cYkq.exe
                                                            • Size 1.7MB
                                                            • SHA256 eef25e6bb352d16c91d25b3c1b00e14ef8b204b141562c559119d86a273887dd
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            eEYq.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\eEYq.exe
                                                            • Size 2.3MB
                                                            • SHA256 de906ecb41f32a56df1b014dc0ca3ae19a9674233e018132b8cab718e89d76e2
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            eQoQ.ico
                                                            • Path C:\Users\Admin\AppData\Local\Temp\eQoQ.ico
                                                            • Size 4KB
                                                            • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            eYss.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\eYss.exe
                                                            • Size 1.8MB
                                                            • SHA256 d14f6dba9279f94bc1087258b3f7b1c5dcb9913723691b41605908a979ad025c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ekcu.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\ekcu.exe
                                                            • Size 1.6MB
                                                            • SHA256 d6e5c544356bcd4c9c2d43cc2f8b07234ed7a59abe8e85efc88cf7c1079426f8
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            file.vbs
                                                            • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                            • Size 19B
                                                            • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            gAUG.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\gAUG.exe
                                                            • Size 1.6MB
                                                            • SHA256 6c4f88f5ccade720f312e1ceac5ee85b67c8bea613a8e9b81d63e524a94c8ebd
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            gIsE.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\gIsE.exe
                                                            • Size 1.6MB
                                                            • SHA256 8e951e945dfebd71f5021463ffd1e001b1bf3faa86bbec065cddd5fe8a80d0ae
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            gMgc.ico
                                                            • Path C:\Users\Admin\AppData\Local\Temp\gMgc.ico
                                                            • Size 4KB
                                                            • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            gUUu.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\gUUu.exe
                                                            • Size 1.9MB
                                                            • SHA256 ec6dbf76515a565178eb4a6ade9a101690cfa3f5ae59e1cf5a50e193b94e1b37
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            gsAI.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\gsAI.exe
                                                            • Size 2.2MB
                                                            • SHA256 69f89343f7225415c591804d36e2d41f3f4ad6f14fc407b73472f081830ed3d0
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            gwYe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\gwYe.exe
                                                            • Size 2.9MB
                                                            • SHA256 180d88c9f4845a4095a3f7f17aca5481e6b183c0696c82a3b7a88e950b9fb44d
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            gwYk.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\gwYk.exe
                                                            • Size 1.8MB
                                                            • SHA256 98d15bfec1cf118f19abe081ae38d0f5ea470ce823d58753d64288470ac99007
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            iIoS.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\iIoS.exe
                                                            • Size 1.8MB
                                                            • SHA256 765ab6b6fadc6df058d453127da3273fdccabe1b41a5e1f6bbffc2d5cda77b2b
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            iQIy.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\iQIy.exe
                                                            • Size 1.9MB
                                                            • SHA256 e6a2ed6556abdb0c586da71cf9b72d5f43dd03467c8a42ed29d049d05aba255a
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            iQYE.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\iQYE.exe
                                                            • Size 1.9MB
                                                            • SHA256 2e87d2376f46a970f62107cfb14780de4eabf2d9ab14af6f1f118a6b2ef0eabf
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ickG.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\ickG.exe
                                                            • Size 2.2MB
                                                            • SHA256 5c46d773bba813ac5c53187b8eb2a51bce88a24014de7fee4fd578622effb6a3
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            isos.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\isos.exe
                                                            • Size 2.3MB
                                                            • SHA256 3f149c8b216649c6a74420fb61ccf1c126c17ee23edbd234e342a5ff4613ba50
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            kCsMAAUs.bat
                                                            • Path C:\Users\Admin\AppData\Local\Temp\kCsMAAUs.bat
                                                            • Size 112B
                                                            • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            kEsK.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\kEsK.exe
                                                            • Size 1.8MB
                                                            • SHA256 cf9ef7e4c553274f1bd454032aa79550dd12b15bd7d919c84f2a824b33490750
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            kQMa.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\kQMa.exe
                                                            • Size 2.0MB
                                                            • SHA256 2e60273e74cbaf8afc350b75629816685c9c9954e370dd2214cee61a657726f1
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            kQUO.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\kQUO.exe
                                                            • Size 1.6MB
                                                            • SHA256 99d94bc1841711806459587705bedd257ae4a0873e9307f527e34487c9045f37
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            kcMO.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\kcMO.exe
                                                            • Size 2.0MB
                                                            • SHA256 936e21b8f4af4585a5d7b8f176e197041bcc774d6aa32547530eba7ba63e59ae
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            mMIM.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\mMIM.exe
                                                            • Size 1.9MB
                                                            • SHA256 cba65e28b517c974e46135c4ced0648039d47a4253ae03dc0455fbb33d333a9a
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            mMYo.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\mMYo.exe
                                                            • Size 2.0MB
                                                            • SHA256 e20eef371eed7213900931ac4a4378d72c7c50ea0506d7c08337abfe1ca33e28
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            mUIc.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\mUIc.exe
                                                            • Size 1.6MB
                                                            • SHA256 8ffdc7438faf8968b44ad39dbb8087e60ade99a4518179945595e5690a101459
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            mkko.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\mkko.exe
                                                            • Size 2.0MB
                                                            • SHA256 00457189fc04a75eaa1091c8fa460f42d28768621351fe4f6e924432febb4457
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            oAwg.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\oAwg.exe
                                                            • Size 1.9MB
                                                            • SHA256 e624036b7dcf00f4f3f249406dd661ea010384a533592aedb9794879065bde9f
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            oIcW.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\oIcW.exe
                                                            • Size 1.7MB
                                                            • SHA256 aee13a520b15e49870f4add3853f0420f5694ce8bb19ca06ac2e0e6ecf3db215
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            oQIE.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\oQIE.exe
                                                            • Size 2.0MB
                                                            • SHA256 c13d1c830167f384236ff6618cb6e1554da8fd7f2cb36683a126b7d59268ab63
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            oYcE.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\oYcE.exe
                                                            • Size 1.6MB
                                                            • SHA256 aea0ffa2eaaefe5487c4223e178f6478f40d8d9fec501039680aca61ae226c5c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ossY.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\ossY.exe
                                                            • Size 1.6MB
                                                            • SHA256 5fb3b869ceb8427f8af085d4e63e7fe7f7954b25dfa7f5e7933e396fd882640f
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            owEW.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\owEW.exe
                                                            • Size 1.6MB
                                                            • SHA256 6cbf0736a390589deac0209ba095d1b51888398498f979d1c2d642289cf1914d
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            owkK.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\owkK.exe
                                                            • Size 1.9MB
                                                            • SHA256 b2a8daee1c52c114a8abcc99228cf4e98e3938b4dc9d2d1112a49a38a516213c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            qcEk.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\qcEk.exe
                                                            • Size 1.9MB
                                                            • SHA256 06100bf2c8758c3b3bb4f0766d666b92d3bc7eadb20294d02e33c3eb03933539
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            qyAE.ico
                                                            • Path C:\Users\Admin\AppData\Local\Temp\qyAE.ico
                                                            • Size 4KB
                                                            • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            sYIO.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\sYIO.exe
                                                            • Size 1.6MB
                                                            • SHA256 3089215cb36b98b6933a08e94315d5140108a719e656b3bac2178ec7dd3e3b47
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            sccg.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\sccg.exe
                                                            • Size 2.2MB
                                                            • SHA256 02b8fd09ce56b6717dae08efc634b691206f6b1a595f69fa057d8ca5726040d6
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            sckg.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\sckg.exe
                                                            • Size 1.6MB
                                                            • SHA256 0cc92d06a253d374ba1e3d7ad8726b9c629ad248eb9943988f3bc28a960f2488
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ssMs.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\ssMs.exe
                                                            • Size 1.8MB
                                                            • SHA256 0e6968bb78c3a7e77e4501e763b9b6a8f180d3208deae18411eb27bbfa61e4a2
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ssUE.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\ssUE.exe
                                                            • Size 1.6MB
                                                            • SHA256 4f12b7ad273f5236bdda59991603ace8c699d27d0bdeb5e492c13045125878de
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ssko.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\ssko.exe
                                                            • Size 1.6MB
                                                            • SHA256 25c1aba6bd2acb97801e9b368dd6b86c1a01677eefcca32bc786d4b7bde70af9
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            uAYy.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\uAYy.exe
                                                            • Size 1.6MB
                                                            • SHA256 540fce183279e98a7e7d4c4012862ae27aa8681a3b1903f544dc8031c3e7a951
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            uMcu.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\uMcu.exe
                                                            • Size 2.2MB
                                                            • SHA256 5f4211485505d3d805761fcbac11c4ecc31b05319d582cf3df720053c1937817
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ucEa.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\ucEa.exe
                                                            • Size 1.8MB
                                                            • SHA256 5d31d1319d5b05cdd80e359cb778b0abc91ecab2a202f756dc724062c5452c7a
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ucUs.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\ucUs.exe
                                                            • Size 1.6MB
                                                            • SHA256 554f6ec0325c6064fbafaabc84376f19eccf25990b249063af286dbc164dc5b4
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ugkS.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\ugkS.exe
                                                            • Size 2.3MB
                                                            • SHA256 dd78b0234a8eaeec0dbdabe020fafb52423af3ff6d736e5f5b7a782d1158984b
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            usoQ.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\usoQ.exe
                                                            • Size 2.0MB
                                                            • SHA256 0fc64b0b26b538f54f68c2d8d6304d3988d2a34919fcf2e987d1afaaad3d62a6
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            uwQo.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\uwQo.exe
                                                            • Size 1.6MB
                                                            • SHA256 7ef173567b9675d271577756c58b93ff3c477f5a367b067d0148a36cb4c6e763
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            wAUk.ico
                                                            • Path C:\Users\Admin\AppData\Local\Temp\wAUk.ico
                                                            • Size 4KB
                                                            • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            wAcg.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\wAcg.exe
                                                            • Size 1.6MB
                                                            • SHA256 95df1daac9d44d43fb5305a0e5beed6866f421b366e077186a31098cc274e1d9
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            wEkU.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\wEkU.exe
                                                            • Size 1.9MB
                                                            • SHA256 797cf0806ddeb9da2c9204c06cc2939d9d5c2df22e72fa76b6545fcdbe4c205c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            wUce.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\wUce.exe
                                                            • Size 1.9MB
                                                            • SHA256 b8d048616a274c8603627a41ac7db3c59ea5d92fb365f210e66b8c3822c362b1
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            wgcQ.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\wgcQ.exe
                                                            • Size 1.6MB
                                                            • SHA256 8c5aef6614eff1e39ecbd076c6f591f0d0e1250adee86a3375948ab1d2f6a850
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            wkgc.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\wkgc.exe
                                                            • Size 2.3MB
                                                            • SHA256 a3232f6abdf2268e967633e130fb5d9a2ba2944688d41499d5658464a3d96737
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            yAYQ.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\yAYQ.exe
                                                            • Size 1.6MB
                                                            • SHA256 2bd73b224296c6ddd10d7bf3936baafb2b80b0d3aa24434399a080ab5043e730
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            yMgi.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\yMgi.exe
                                                            • Size 1.9MB
                                                            • SHA256 febe3cc8e66cb965374ff0b71964c4236a004ff08de45c3d7bbb55dcf0abf993
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            yMwi.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\yMwi.exe
                                                            • Size 1.8MB
                                                            • SHA256 c0cb61ad01058686d52be1e8e7897c9f1e2da73bc512c8575f4f8b675f007b79
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            yQUe.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\yQUe.exe
                                                            • Size 1.6MB
                                                            • SHA256 de8b818fac30f0badb045a5d1e39b48ee43c69aeda9d814e2aeedf6ffd046014
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            yQYI.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\yQYI.exe
                                                            • Size 1.6MB
                                                            • SHA256 37ca0a7fd951e1accc53dd14f98ea2d3df151f68c0ad61a2a8e7b13ef8ad317f
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            yUAy.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\yUAy.exe
                                                            • Size 2.0MB
                                                            • SHA256 b4ae94b1d6d2bfa7b2c63bab5ed1c036ea3e65478810035374c4c8c0fdea019b
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            yYMQ.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\yYMQ.exe
                                                            • Size 2.4MB
                                                            • SHA256 f0d3f5ec6203c843e441cf6ddb98267a31b976f94e8f991fa938c7bceaed9317
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            yYcw.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\yYcw.exe
                                                            • Size 1.8MB
                                                            • SHA256 dea171d0819ac4fb7ea9c127f8bd9cc2cfd9b380460a6ee3afe0792bc1b6a80d
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            QeUAowkE.exe
                                                            • Path C:\Users\Admin\hUUUskAA\QeUAowkE.exe
                                                            • Size 1.6MB
                                                            • SHA256 c743d8a4ae9fd412c0df51b112dcafe62b6cef8b779c70f2599065cd46409ead
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            QeUAowkE.inf
                                                            • Path C:\Users\Admin\hUUUskAA\QeUAowkE.inf
                                                            • Size 4B
                                                            • SHA256 3e060e759ee8ed65010ae57ec2068efe8eef6f244feb20674af14ff0b1f36fc8
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            QeUAowkE.inf
                                                            • Path C:\Users\Admin\hUUUskAA\QeUAowkE.inf
                                                            • Size 4B
                                                            • SHA256 662905768725166058e5c4e4a81827e372ec6bc4113edd414519de3703412a41
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            QeUAowkE.inf
                                                            • Path C:\Users\Admin\hUUUskAA\QeUAowkE.inf
                                                            • Size 4B
                                                            • SHA256 778706040ca281de956afecbf3f1eceef13c371d8751bebda589ea4449bbd531
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            QeUAowkE.inf
                                                            • Path C:\Users\Admin\hUUUskAA\QeUAowkE.inf
                                                            • Size 4B
                                                            • SHA256 1ad97a59f645180786fc8227e4affb67eeb38fec9fe41379a1d8cb62b29d11ed
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            QeUAowkE.inf
                                                            • Path C:\Users\Admin\hUUUskAA\QeUAowkE.inf
                                                            • Size 4B
                                                            • SHA256 775cb1559fb79817ffbd8a9fa57761d447197c7857a851c5d46b6ef2f330c649
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            memory/680-238-0x0000000000400000-0x0000000000592000-memory.dmp
                                                            Download

                                                            memory/1248-187-0x0000000000400000-0x0000000000592000-memory.dmp
                                                            Download

                                                            memory/2108-170-0x0000000000400000-0x0000000000592000-memory.dmp
                                                            Download

                                                            memory/2384-228-0x0000000000400000-0x0000000000592000-memory.dmp
                                                            Download

                                                            memory/2756-83-0x0000000000400000-0x0000000000592000-memory.dmp
                                                            Download

                                                            memory/3124-94-0x0000000000400000-0x0000000000592000-memory.dmp
                                                            Download

                                                            memory/3388-216-0x0000000000400000-0x0000000000592000-memory.dmp
                                                            Download

                                                            memory/3872-259-0x0000000000400000-0x0000000000592000-memory.dmp
                                                            Download

                                                            memory/3880-1975-0x0000000000400000-0x0000000000590000-memory.dmp
                                                            Download

                                                            memory/3880-17-0x0000000000400000-0x0000000000590000-memory.dmp
                                                            Download

                                                            memory/4076-1970-0x0000000000400000-0x0000000000590000-memory.dmp
                                                            Download

                                                            memory/4076-275-0x0000000002220000-0x0000000002240000-memory.dmp
                                                            Download

                                                            memory/4076-1788-0x0000000002220000-0x0000000002240000-memory.dmp
                                                            Download

                                                            memory/4076-7-0x0000000000400000-0x0000000000590000-memory.dmp
                                                            Download

                                                            memory/4156-156-0x0000000000400000-0x0000000000592000-memory.dmp
                                                            Download

                                                            memory/4212-1980-0x0000000000400000-0x0000000000590000-memory.dmp
                                                            Download

                                                            memory/4360-1994-0x0000000000400000-0x0000000000590000-memory.dmp
                                                            Download

                                                            memory/4488-67-0x0000000000400000-0x0000000000592000-memory.dmp
                                                            Download

                                                            memory/4536-113-0x0000000000400000-0x0000000000592000-memory.dmp
                                                            Download

                                                            memory/4800-201-0x0000000000400000-0x0000000000592000-memory.dmp
                                                            Download

                                                            memory/4856-250-0x0000000000400000-0x0000000000592000-memory.dmp
                                                            Download

                                                            memory/4960-38-0x0000000000400000-0x0000000000592000-memory.dmp
                                                            Download

                                                            memory/4960-39-0x00000000008A0000-0x00000000008C0000-memory.dmp
                                                            Download

                                                            memory/4960-0-0x0000000000400000-0x0000000000592000-memory.dmp
                                                            Download

                                                            memory/4960-1-0x00000000008A0000-0x00000000008C0000-memory.dmp
                                                            Download

                                                            memory/5140-21-0x0000000000400000-0x0000000000590000-memory.dmp
                                                            Download

                                                            memory/5140-1985-0x0000000000400000-0x0000000000590000-memory.dmp
                                                            Download

                                                            memory/5396-145-0x0000000000400000-0x0000000000592000-memory.dmp
                                                            Download

                                                            memory/5436-127-0x0000000000400000-0x0000000000592000-memory.dmp
                                                            Download

                                                            memory/5588-50-0x0000000000400000-0x0000000000592000-memory.dmp
                                                            Download

                                                            memory/5832-269-0x0000000000400000-0x0000000000592000-memory.dmp
                                                            Download