Overview

overview

10

Static

static

3

2026-07-21...ck.exe

windows10-2004-x64

10

2026-07-21...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/07/2026, 22:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
  • Size 1.6MB
  • Sample260721-2bs8bsstcv
  • SHA256 d5fd31f629181dfc61458f85abdaec854618ae445054b5d5b373f83d57090538
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 34 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 34 IoCs
    defense_evasiontrojan
  • Renames multiple (100) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 34 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4680
    • C:\Users\Admin\gYYYgcgU\QmkIQokM.exe
      "C:\Users\Admin\gYYYgcgU\QmkIQokM.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:4004
    • C:\ProgramData\YwwAEAUo\MywwMkYk.exe
      "C:\ProgramData\YwwAEAUo\MywwMkYk.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      PID:2884
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4780
      • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4088
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2952
          • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5732
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:936
              • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1724
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1084
                  • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:1588
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:4708
                      • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:1504
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:1028
                          • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                            13⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:6120
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:4288
                              • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:4544
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:5352
                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:3288
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:1364
                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                        19⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:3740
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                          20⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          PID:3796
                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                            21⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3372
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                              22⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              PID:3680
                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                                C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                                23⤵
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:748
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1192
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                                    25⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4012
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      PID:3584
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                                        27⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:2668
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4188
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                                            29⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:3528
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              PID:2500
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                                                31⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:2756
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  PID:5904
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                                                    33⤵
                                                                      PID:2580
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                                                        34⤵
                                                                        • Executes a command shell one-liner
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:2968
                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                                                          35⤵
                                                                            PID:5676
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                                                              36⤵
                                                                              • Executes a command shell one-liner
                                                                              PID:4196
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                                                                37⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:4760
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                                                                  38⤵
                                                                                  • Executes a command shell one-liner
                                                                                  PID:2512
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                                                                    39⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:4140
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                                                                      40⤵
                                                                                      • Executes a command shell one-liner
                                                                                      PID:5048
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                                                                        41⤵
                                                                                          PID:3916
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                                                                            42⤵
                                                                                            • Executes a command shell one-liner
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2140
                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                                                                              43⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:3924
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                                                                                44⤵
                                                                                                • Executes a command shell one-liner
                                                                                                PID:1928
                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                                                                                  45⤵
                                                                                                    PID:612
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                                                                                      46⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      PID:2084
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                                                                                        47⤵
                                                                                                          PID:2556
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                                                                                            48⤵
                                                                                                            • Executes a command shell one-liner
                                                                                                            PID:4248
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                                                                                              49⤵
                                                                                                                PID:4808
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                                                                                                  50⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:4716
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                                                                                                    51⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:4876
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                                                                                                      52⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      PID:2928
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                                                                                                        53⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:1632
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                                                                                                          54⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:3296
                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                            55⤵
                                                                                                                              PID:3980
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                                                                                                              55⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:2600
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                                                                                                                56⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:872
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                                                                                                                  57⤵
                                                                                                                                    PID:2944
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                                                                                                                      58⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:924
                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                        59⤵
                                                                                                                                          PID:5976
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                                                                                                                          59⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:5276
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                                                                                                                            60⤵
                                                                                                                                              PID:4256
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                                                                                                                                61⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:5888
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                                                                                                                                  62⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:4020
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                                                                                                                                    63⤵
                                                                                                                                                      PID:5568
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                                                                                                                                        64⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:668
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                                                                                                                                          65⤵
                                                                                                                                                            PID:2036
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                                                                                                                                              66⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:5320
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                                                                                                                                                67⤵
                                                                                                                                                                  PID:5236
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock"
                                                                                                                                                                    68⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:2700
                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                      69⤵
                                                                                                                                                                        PID:1164
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                      68⤵
                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                      PID:4244
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                      68⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:948
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                      68⤵
                                                                                                                                                                      • UAC bypass
                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                      PID:4484
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AaIMAMUU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                                                                                                      68⤵
                                                                                                                                                                        PID:1200
                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                          69⤵
                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                          PID:4772
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                    66⤵
                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:2368
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                    66⤵
                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                    PID:5496
                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                      67⤵
                                                                                                                                                                        PID:2804
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                      66⤵
                                                                                                                                                                      • UAC bypass
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                      PID:1076
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IYoQIksI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                                                                                                      66⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:3432
                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                        67⤵
                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                        PID:688
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                  64⤵
                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                  PID:3104
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                  64⤵
                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                  PID:4900
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                  64⤵
                                                                                                                                                                  • UAC bypass
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                  PID:4596
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jYwogkAI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                                                                                                  64⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:2728
                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                    65⤵
                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:5628
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                              62⤵
                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:976
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                              62⤵
                                                                                                                                                                PID:6104
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                62⤵
                                                                                                                                                                • UAC bypass
                                                                                                                                                                PID:2624
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ogwkkEkg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                                                                                                62⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                PID:4024
                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                  63⤵
                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                  PID:840
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                            60⤵
                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                            • Modifies registry key
                                                                                                                                                            PID:2784
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                            60⤵
                                                                                                                                                              PID:5764
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                              60⤵
                                                                                                                                                              • UAC bypass
                                                                                                                                                              PID:5796
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FiEUAgoI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                                                                                              60⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:5108
                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                61⤵
                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                PID:4292
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                          58⤵
                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                          PID:3440
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                          58⤵
                                                                                                                                                          • Modifies registry key
                                                                                                                                                          PID:5572
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                          58⤵
                                                                                                                                                          • UAC bypass
                                                                                                                                                          • Modifies registry key
                                                                                                                                                          PID:6104
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UIUQgMkY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                                                                                          58⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:2712
                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                            59⤵
                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:4276
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                      56⤵
                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:3024
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                      56⤵
                                                                                                                                                      • Modifies registry key
                                                                                                                                                      PID:4472
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                      56⤵
                                                                                                                                                      • UAC bypass
                                                                                                                                                      • Modifies registry key
                                                                                                                                                      PID:3688
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sGEcoMgo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                                                                                      56⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:5972
                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                        57⤵
                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                        PID:6016
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                  54⤵
                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                  • Modifies registry key
                                                                                                                                                  PID:124
                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                    55⤵
                                                                                                                                                      PID:4428
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                    54⤵
                                                                                                                                                      PID:4216
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                      54⤵
                                                                                                                                                      • UAC bypass
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      • Modifies registry key
                                                                                                                                                      PID:5092
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fowEQQQo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                                                                                      54⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:6084
                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                        55⤵
                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                        PID:5672
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                  52⤵
                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                  • Modifies registry key
                                                                                                                                                  PID:4588
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                  52⤵
                                                                                                                                                  • Modifies registry key
                                                                                                                                                  PID:6116
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                  52⤵
                                                                                                                                                  • UAC bypass
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  • Modifies registry key
                                                                                                                                                  PID:4624
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vCoYwEME.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                                                                                  52⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:2404
                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                    53⤵
                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:5592
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                              50⤵
                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                              • Modifies registry key
                                                                                                                                              PID:4524
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                              50⤵
                                                                                                                                              • Modifies registry key
                                                                                                                                              PID:1072
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                              50⤵
                                                                                                                                              • UAC bypass
                                                                                                                                              • Modifies registry key
                                                                                                                                              PID:2596
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CqcoYUYM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                                                                              50⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:3232
                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                51⤵
                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                PID:2840
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                          48⤵
                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                          PID:2788
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                          48⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:3712
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                          48⤵
                                                                                                                                          • UAC bypass
                                                                                                                                          • Modifies registry key
                                                                                                                                          PID:3436
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dCcQMEUY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                                                                          48⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:4128
                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                            49⤵
                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                            PID:4468
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                      46⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:4796
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                      46⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:5948
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                      46⤵
                                                                                                                                      • UAC bypass
                                                                                                                                      PID:2096
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TukcwIMU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                                                                      46⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:816
                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                        47⤵
                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                        PID:5712
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                  44⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  • Modifies registry key
                                                                                                                                  PID:3840
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                  44⤵
                                                                                                                                  • Modifies registry key
                                                                                                                                  PID:2036
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                  44⤵
                                                                                                                                  • UAC bypass
                                                                                                                                  • Modifies registry key
                                                                                                                                  PID:2784
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\facAcMEI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                                                                  44⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:2932
                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                    45⤵
                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                    PID:5812
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                              42⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              PID:2820
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                              42⤵
                                                                                                                                PID:2088
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                42⤵
                                                                                                                                • UAC bypass
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Modifies registry key
                                                                                                                                PID:668
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IYQssUIA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                                                                42⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:3344
                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                  43⤵
                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                  PID:1556
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                            40⤵
                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                            • Modifies registry key
                                                                                                                            PID:688
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                            40⤵
                                                                                                                            • Modifies registry key
                                                                                                                            PID:3248
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                            40⤵
                                                                                                                            • UAC bypass
                                                                                                                            PID:2928
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IAYYgMkY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                                                            40⤵
                                                                                                                            • Executes a command shell one-liner
                                                                                                                            PID:6008
                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                              41⤵
                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                              PID:3268
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                        38⤵
                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                        • Modifies registry key
                                                                                                                        PID:364
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                        38⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Modifies registry key
                                                                                                                        PID:1080
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                        38⤵
                                                                                                                        • UAC bypass
                                                                                                                        • Modifies registry key
                                                                                                                        PID:1072
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MmosIkMM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                                                        38⤵
                                                                                                                        • Executes a command shell one-liner
                                                                                                                        PID:2976
                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                          39⤵
                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                          PID:2448
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                    36⤵
                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Modifies registry key
                                                                                                                    PID:4264
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                    36⤵
                                                                                                                    • Modifies registry key
                                                                                                                    PID:5976
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                    36⤵
                                                                                                                    • UAC bypass
                                                                                                                    • Modifies registry key
                                                                                                                    PID:4032
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TMcsYQow.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                                                    36⤵
                                                                                                                    • Executes a command shell one-liner
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:4120
                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                      37⤵
                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                      PID:3172
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                34⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Modifies registry key
                                                                                                                PID:5888
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                34⤵
                                                                                                                  PID:3760
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                  34⤵
                                                                                                                  • UAC bypass
                                                                                                                  • Modifies registry key
                                                                                                                  PID:5812
                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                    35⤵
                                                                                                                      PID:5916
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RiYUwYwo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                                                    34⤵
                                                                                                                    • Executes a command shell one-liner
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:1244
                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                      35⤵
                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                      PID:6072
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                32⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Modifies registry key
                                                                                                                PID:4328
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                32⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Modifies registry key
                                                                                                                PID:2804
                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  33⤵
                                                                                                                    PID:3520
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                  32⤵
                                                                                                                  • UAC bypass
                                                                                                                  • Modifies registry key
                                                                                                                  PID:848
                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                    33⤵
                                                                                                                      PID:4584
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pyccYIQU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                                                    32⤵
                                                                                                                    • Executes a command shell one-liner
                                                                                                                    PID:2072
                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                      33⤵
                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                      PID:5656
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                30⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                • Modifies registry key
                                                                                                                PID:2680
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                30⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:2604
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                30⤵
                                                                                                                • UAC bypass
                                                                                                                • Modifies registry key
                                                                                                                PID:4596
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ygccgwgI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                                                30⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                PID:2180
                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                  31⤵
                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                  PID:1576
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                            28⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            • Modifies registry key
                                                                                                            PID:3248
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                            28⤵
                                                                                                            • Modifies registry key
                                                                                                            PID:5472
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                            28⤵
                                                                                                            • UAC bypass
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:1332
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\swQkIQQk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                                            28⤵
                                                                                                            • Executes a command shell one-liner
                                                                                                            PID:5756
                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                              29⤵
                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                              PID:4428
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                        26⤵
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        • Modifies registry key
                                                                                                        PID:5476
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                        26⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:2700
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                        26⤵
                                                                                                        • UAC bypass
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Modifies registry key
                                                                                                        PID:1480
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oWIMEwkY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                                        26⤵
                                                                                                        • Executes a command shell one-liner
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:4444
                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                          27⤵
                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                          PID:4808
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                    24⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    • Modifies registry key
                                                                                                    PID:3712
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                    24⤵
                                                                                                      PID:3980
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                      24⤵
                                                                                                      • UAC bypass
                                                                                                      PID:5492
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tsQUEoYM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                                      24⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      PID:3512
                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                        25⤵
                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                        PID:4620
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                  22⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  PID:4776
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                  22⤵
                                                                                                    PID:1244
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                    22⤵
                                                                                                    • UAC bypass
                                                                                                    • Modifies registry key
                                                                                                    PID:5916
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NmgIswEg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                                    22⤵
                                                                                                    • Executes a command shell one-liner
                                                                                                    PID:4616
                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                      23⤵
                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:1064
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                20⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:2804
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                20⤵
                                                                                                • Modifies registry key
                                                                                                PID:3520
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                20⤵
                                                                                                • UAC bypass
                                                                                                • Modifies registry key
                                                                                                PID:1600
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NukkIgQM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                                20⤵
                                                                                                • Executes a command shell one-liner
                                                                                                PID:2696
                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                  21⤵
                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                  PID:4556
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                            18⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • Modifies registry key
                                                                                            PID:6096
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                            18⤵
                                                                                            • Modifies registry key
                                                                                            PID:3268
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                            18⤵
                                                                                            • UAC bypass
                                                                                            PID:2904
                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                              19⤵
                                                                                                PID:804
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xiQAUYUo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                              18⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:4660
                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                19⤵
                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                PID:6116
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                          16⤵
                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                          • Modifies registry key
                                                                                          PID:1164
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                          16⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:3232
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                          16⤵
                                                                                          • UAC bypass
                                                                                          • Modifies registry key
                                                                                          PID:2404
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iGoIQcYU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                          16⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:460
                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                            17⤵
                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                            PID:1872
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                      14⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Modifies registry key
                                                                                      PID:4444
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                      14⤵
                                                                                        PID:3504
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                        14⤵
                                                                                        • UAC bypass
                                                                                        • Modifies registry key
                                                                                        PID:2700
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OWQMkskE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                        14⤵
                                                                                        • Executes a command shell one-liner
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4112
                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                          15⤵
                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                          PID:4140
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                    12⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • Modifies registry key
                                                                                    PID:3712
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                    12⤵
                                                                                      PID:3676
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                      12⤵
                                                                                      • UAC bypass
                                                                                      • Modifies registry key
                                                                                      PID:924
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tKgoAIYU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                      12⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1432
                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                        13⤵
                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                        PID:2412
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                  10⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  PID:480
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                  10⤵
                                                                                    PID:5916
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                    10⤵
                                                                                    • UAC bypass
                                                                                    • Modifies registry key
                                                                                    PID:748
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TIIsIQso.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                    10⤵
                                                                                    • Executes a command shell one-liner
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3280
                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                      11⤵
                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                      PID:2452
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                8⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Modifies registry key
                                                                                PID:4584
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                8⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5948
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                8⤵
                                                                                • UAC bypass
                                                                                PID:2332
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JKYogUYE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                                8⤵
                                                                                • Executes a command shell one-liner
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3212
                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                  9⤵
                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                  PID:2368
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                            6⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Modifies registry key
                                                                            PID:2784
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                            6⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:872
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                            6⤵
                                                                            • UAC bypass
                                                                            • Modifies registry key
                                                                            PID:804
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NWwkwYIQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                            6⤵
                                                                            • Executes a command shell one-liner
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:6092
                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                              7⤵
                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                              PID:2036
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                        4⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Modifies registry key
                                                                        PID:4428
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                        4⤵
                                                                        • Modifies registry key
                                                                        PID:4576
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                        4⤵
                                                                        • UAC bypass
                                                                        PID:2608
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cSosIoAw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                        4⤵
                                                                        • Executes a command shell one-liner
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:6056
                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                          5⤵
                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                          PID:3260
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                    2⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • Modifies registry key
                                                                    PID:1480
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                    2⤵
                                                                      PID:5476
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                      2⤵
                                                                      • UAC bypass
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies registry key
                                                                      PID:52
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\beowogEM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock.exe""
                                                                      2⤵
                                                                      • Executes a command shell one-liner
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4304
                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                        3⤵
                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                        PID:4976
                                                                  • C:\ProgramData\QgIwkQEU\RAIYMYMM.exe
                                                                    C:\ProgramData\QgIwkQEU\RAIYMYMM.exe
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • Adds Run key to start application
                                                                    • Drops file in System32 directory
                                                                    PID:5304
                                                                  • C:\Users\Admin\gYYYgcgU\QmkIQokM.exe
                                                                    C:\Users\Admin\gYYYgcgU\QmkIQokM.exe
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • Adds Run key to start application
                                                                    PID:3108
                                                                  • C:\ProgramData\YwwAEAUo\MywwMkYk.exe
                                                                    C:\ProgramData\YwwAEAUo\MywwMkYk.exe
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • Adds Run key to start application
                                                                    PID:2576
                                                                  • C:\Windows\System32\sihclient.exe
                                                                    C:\Windows\System32\sihclient.exe /cv p7zrfKpDmEuKFrUAe4xZ7g.0.2
                                                                    1⤵
                                                                      PID:4276

                                                                    Network

                                                                          MITRE ATT&CK Enterprise v16

                                                                          Reconnaissance

                                                                          Resource Development

                                                                          Initial Access

                                                                          Execution

                                                                          Command and Scripting Interpreter

                                                                          2
                                                                          T1059

                                                                          Visual Basic

                                                                          1
                                                                          T1059.005

                                                                          Windows Command Shell

                                                                          1
                                                                          T1059.003

                                                                          Persistence

                                                                          Boot or Logon Autostart Execution

                                                                          1
                                                                          T1547

                                                                          Registry Run Keys / Startup Folder

                                                                          1
                                                                          T1547.001

                                                                          Privilege Escalation

                                                                          Abuse Elevation Control Mechanism

                                                                          1
                                                                          T1548

                                                                          Bypass User Account Control

                                                                          1
                                                                          T1548.002

                                                                          Boot or Logon Autostart Execution

                                                                          1
                                                                          T1547

                                                                          Registry Run Keys / Startup Folder

                                                                          1
                                                                          T1547.001

                                                                          Defense Evasion

                                                                          Abuse Elevation Control Mechanism

                                                                          1
                                                                          T1548

                                                                          Bypass User Account Control

                                                                          1
                                                                          T1548.002

                                                                          Hide Artifacts

                                                                          1
                                                                          T1564

                                                                          Hidden Files and Directories

                                                                          1
                                                                          T1564.001

                                                                          Impair Defenses

                                                                          1
                                                                          T1562

                                                                          Disable or Modify Tools

                                                                          1
                                                                          T1562.001

                                                                          Modify Registry

                                                                          4
                                                                          T1112

                                                                          Credential Access

                                                                          Credentials from Password Stores

                                                                          1
                                                                          T1555

                                                                          Credentials from Web Browsers

                                                                          1
                                                                          T1555.003

                                                                          Unsecured Credentials

                                                                          1
                                                                          T1552

                                                                          Credentials In Files

                                                                          1
                                                                          T1552.001

                                                                          Discovery

                                                                          System Information Discovery

                                                                          1
                                                                          T1082

                                                                          System Location Discovery

                                                                          1
                                                                          T1614

                                                                          System Language Discovery

                                                                          1
                                                                          T1614.001

                                                                          Lateral Movement

                                                                          Collection

                                                                          Data from Local System

                                                                          1
                                                                          T1005

                                                                          Command and Control

                                                                          Exfiltration

                                                                          Impact

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          RAIYMYMM.exe
                                                                          • Path C:\ProgramData\QgIwkQEU\RAIYMYMM.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 edf4264ccc78d9b7972e56d9970e437ff49d967ca3953cd2579ffc9340ecffe6
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          MywwMkYk.exe
                                                                          • Path C:\ProgramData\YwwAEAUo\MywwMkYk.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 054b91ec1015b70037950ba3b0826dd45d5235744886a7741e96b35e9ba44734
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          MywwMkYk.inf
                                                                          • Path C:\ProgramData\YwwAEAUo\MywwMkYk.inf
                                                                          • Size 4B
                                                                          • SHA256 479017fffbe11d9a3f003f41262af65fb1b09209e545d2712e049a6dddb28705
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          iIUY.txt
                                                                          • Path C:\ProgramData\iIUY.txt
                                                                          • Size 9KB
                                                                          • SHA256 cdba811bb5ef7f92177cccf22e3f2ce57adc052d1371d7eb49a60c20815e0964
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-07-21_bb934e7a6249f8dd78e45666abb406c0_elex_virlock
                                                                          • Size 3KB
                                                                          • SHA256 85635ee59fbacbfc47372ff02a34e246f0b170c88584a613ca4f035b50386de6
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          AAUS.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\AAUS.exe
                                                                          • Size 2.4MB
                                                                          • SHA256 47d104c9e1ef3e5a5e500cfc2f3ecd2d795c1d38c27179d7509efa239255696b
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          AEIK.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\AEIK.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 f8bc2418fbffedb2050bca2462f929526d978f7d79779172ba2737410cd173ee
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          AIAG.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\AIAG.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 fc8cbc132b1c544ddc1aceb0e35cfedb56ae818f0e4fc1ea8628756c76081538
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          AIMO.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\AIMO.exe
                                                                          • Size 2.2MB
                                                                          • SHA256 c885e834e479519e07726b205cd8c07eca868fa5ed481cadb59d018931cd95fd
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          AMAa.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\AMAa.exe
                                                                          • Size 1.9MB
                                                                          • SHA256 5eaa59520229e2100b2123439a64cf059c26efea4bf00d4d006998d237c597be
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          AgwW.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\AgwW.exe
                                                                          • Size 2.3MB
                                                                          • SHA256 f2bb45d7f99780e92b4bd4fee15fa684c2cb45911974fd3b40c78a10d59980b5
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          CCQE.ico
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\CCQE.ico
                                                                          • Size 4KB
                                                                          • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          CMkS.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\CMkS.exe
                                                                          • Size 3.1MB
                                                                          • SHA256 b204f927f2fca3b8e7297503eb3a11a3beb7ec597f2b3cc56ff4bb7f63f04a3c
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          CQYq.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\CQYq.exe
                                                                          • Size 2.0MB
                                                                          • SHA256 f660c0aa0b109fb255d60572572040f5ce17a57b2bf2e5019cc6a000df4b6e32
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          CUkm.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\CUkm.exe
                                                                          • Size 3.2MB
                                                                          • SHA256 d86f308f47a4ed92e830ec2fa085cb20d013ac3785c328e66ab1616972240655
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          CgEM.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\CgEM.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 e43806a62b295d7af19c78fa715a9308bacd5d41f2becf3b1cb931a5c082fcb9
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          CsAC.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\CsAC.exe
                                                                          • Size 1.9MB
                                                                          • SHA256 b2ff6da7e256c24fe1d60d217437d859c0799837d6aace661086ecf09135f87d
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          CwMa.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\CwMa.exe
                                                                          • Size 2.2MB
                                                                          • SHA256 ede2e4c4a7ebadd1826d574cc67202163bcda6b8a182436bcdc53ac8a21374dc
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          EAse.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\EAse.exe
                                                                          • Size 1.7MB
                                                                          • SHA256 c0f363146392937cd00e0f0f242ef3e62ad36d83544fd0e1cf14e85422619918
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          EEsa.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\EEsa.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 0ce5c7e9ffec7ee71d4f9a9fbb84719f2923391d0a5e37437f5a9d5f1a5a15b1
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          EIgI.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\EIgI.exe
                                                                          • Size 1.8MB
                                                                          • SHA256 4f305d95c6dc6c1734b26dc87842bd14655af6494dbbb04d80f19dc403dce192
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          EQAK.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\EQAK.exe
                                                                          • Size 2.4MB
                                                                          • SHA256 761d4b0343d2c101383817b35ac805120da90fd06e434d2f88600451a983bb78
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          EQIM.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\EQIM.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 a1d79f2b9128626f8435e19cf59a90343b22369ef715f101d77b7eec441d928d
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Ekoo.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Ekoo.exe
                                                                          • Size 2.0MB
                                                                          • SHA256 01b98f2d5023aacd89990ccafc680e2943dab99dbdf2589557c032d3b4bc4cbd
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          GEMo.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\GEMo.exe
                                                                          • Size 2.0MB
                                                                          • SHA256 3a4dbc8807af77abd1b29e374cdbd4150ec8c993c4e1815d424640ecc44e1307
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          IEcQ.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\IEcQ.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 f7903bbdf5cfeb8162ee979b8ad76c22ad228052bb45e7e9173f445d88be154c
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          IEwQ.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\IEwQ.exe
                                                                          • Size 1.7MB
                                                                          • SHA256 efac252d71dc9503511df123aed6484b165edf7fece8d871cb1ebdccff0756fc
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          IgMg.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\IgMg.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 973c108ca93f2ee1580c723811e0234404727ec6444f3546edc985e7036e20a2
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Iocu.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Iocu.exe
                                                                          • Size 2.8MB
                                                                          • SHA256 ef6a72fb16e05a3da3c51d217089cd3258a80186b8305ebacc9efa3f385add53
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          IqAQ.ico
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\IqAQ.ico
                                                                          • Size 4KB
                                                                          • SHA256 bc4ed7d844af9da0a5d2fe12e8db07fbfdf6e0ecd557223b292bd0e9cb6a64a1
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          KAEG.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\KAEG.exe
                                                                          • Size 1.7MB
                                                                          • SHA256 01fc4dbc9d405051f4873252ebddf91825fa110b79d11ecdc03c539bd5bfe09d
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          KYMS.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\KYMS.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 647d9a387853140a836158fe74040fa4ee948b1afc9f61c251bc0975688e0662
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          KcIQ.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\KcIQ.exe
                                                                          • Size 1.8MB
                                                                          • SHA256 246ed59ec493ca49e3441a21b902a4283806e090c5301612d7394f0078dd4b70
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          KgQm.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\KgQm.exe
                                                                          • Size 2.5MB
                                                                          • SHA256 a4db0c78865f0ddd8c87288303953c41d42690dbc91487130573f3e3956d5048
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          KgcW.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\KgcW.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 30a60e182e2dea1612e0c49ba5c36ab9c789de776fbcade97970af8ff92463c2
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          KgsS.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\KgsS.exe
                                                                          • Size 1.7MB
                                                                          • SHA256 794856625c198275ceceee479c3b7639cc195fda1520562821d4ff1950acbe0d
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          KoYQ.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\KoYQ.exe
                                                                          • Size 1.8MB
                                                                          • SHA256 1729e2ec08e04709770c4b2656be5ea9c7cfa7011de5e4cf5a4ee5ceeb2baa8b
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Kokc.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Kokc.exe
                                                                          • Size 2.1MB
                                                                          • SHA256 5bf14d6237f6204f2cd47c3fe57782847e0707053782c982a0525181c215c18e
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          KsII.ico
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\KsII.ico
                                                                          • Size 4KB
                                                                          • SHA256 e1131246c60ad423586203bb8b9287e365051101ddbf532132bd47ef03ab86c8
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          KugI.ico
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\KugI.ico
                                                                          • Size 4KB
                                                                          • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          MAgS.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MAgS.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 1eb37349aba16769874227a988981d58dc1b79663d889a7b6553ae8c04ba4c9f
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          MMAy.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MMAy.exe
                                                                          • Size 2.1MB
                                                                          • SHA256 a9ee2bcd8a55558a2d28b4a79364be340cea7334906cc75d9959cd707c4d70d7
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          MQkq.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MQkq.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 57daa8b213cbf642417830affc9a78e19137d87e6a1fb1217b644cb314c72a10
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          MsYG.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MsYG.exe
                                                                          • Size 1.7MB
                                                                          • SHA256 0f51f4c165bad7396b0c466c16b37d6a91ce9715dc3dc78b0279417d91b8d22e
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          OAUg.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\OAUg.exe
                                                                          • Size 2.1MB
                                                                          • SHA256 51db46a97c11e050746abed55e2dd73203b8200bd97f059a07bd35612cd3a0a3
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          OOgY.ico
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\OOgY.ico
                                                                          • Size 4KB
                                                                          • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          OwAg.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\OwAg.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 c5cd66cc4e99f1a9884f288b6639bc6fbcd1023740168291e5aa2c84fdc46a63
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          QIMu.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\QIMu.exe
                                                                          • Size 2.0MB
                                                                          • SHA256 f0eb0aae5176208f90d03f0e27028f5a82703c88496abf427ed342ba1700c0eb
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          QOAw.ico
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\QOAw.ico
                                                                          • Size 4KB
                                                                          • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          QUEe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\QUEe.exe
                                                                          • Size 2.3MB
                                                                          • SHA256 7133784d22f2f2a89b13377946e406bc0d055530964b3e94928621ccf6ac1722
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          QsYq.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\QsYq.exe
                                                                          • Size 2.4MB
                                                                          • SHA256 38a2fff108dec8eccc388db5d2e13b9ffca287b5371690e4d7c08f8ff0ba5a94
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          SAgU.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\SAgU.exe
                                                                          • Size 2.5MB
                                                                          • SHA256 881053c63c4e61aabfd8240a70b64ca1552c0ea5b57fbccc50e2eb22a05b1dff
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          SQgC.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\SQgC.exe
                                                                          • Size 2.0MB
                                                                          • SHA256 80632aaa49779b1285afb0e52260f3aceaaf77bdcea3e367948929f247eaf967
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          SYkg.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\SYkg.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 4687a3185d06e4735da4d09a10fac1ea3c6f7a601c0d88b53f3c568e07df2678
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          ScAm.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ScAm.exe
                                                                          • Size 2.2MB
                                                                          • SHA256 dd4a69699dd87199697d69c81e7ef1ac40fde10160c6f3b090c3fb0b13346d76
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          UIAQ.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\UIAQ.exe
                                                                          • Size 2.0MB
                                                                          • SHA256 19849ff91bc76183894b360d053f1fe91305b85190d0f496d0d966737685741a
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          UUYo.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\UUYo.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 62d6440bd51dce00cb90a41f97d74b1ae1d1ad8461ab34792075fcb898682fdf
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          UUYu.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\UUYu.exe
                                                                          • Size 3.2MB
                                                                          • SHA256 b8662bd8c9d3fe5cdfc60260feb69e153d0243c53b2f42c562a4a956f2e3fa15
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Ugco.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Ugco.exe
                                                                          • Size 1.9MB
                                                                          • SHA256 02b13553a132722379239f2b51b66c0e472422788f52e4293d3d87498b534e33
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          UkEG.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\UkEG.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 fe846936b9712c98a80375e05a967a98ad8583bd06a6553a6b451bda28b31e98
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          UkgS.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\UkgS.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 0907a34474f7d11a7fe22e39db1bf2cc701284cfef13ef1f2560c6cb172c8e32
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          UoUm.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\UoUm.exe
                                                                          • Size 2.7MB
                                                                          • SHA256 1489e7d4bfa8a3bd964cefa5dce09fa8acdf6255c7d4019186d16dadcf175f1a
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          WAoq.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\WAoq.exe
                                                                          • Size 2.7MB
                                                                          • SHA256 84ece9e0412b83b257b44e726fc05dec14c7d3858af8015544d75e99df6655b4
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          WGcE.ico
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\WGcE.ico
                                                                          • Size 4KB
                                                                          • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          WIEK.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\WIEK.exe
                                                                          • Size 1.7MB
                                                                          • SHA256 e5925b6fd54f418432e96d3184eb90ed66073943c693e3674632684b2a21add5
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          WWwk.ico
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\WWwk.ico
                                                                          • Size 4KB
                                                                          • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          WgsY.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\WgsY.exe
                                                                          • Size 2.4MB
                                                                          • SHA256 c952260c5d0717b04b5a6289250ef1d427d5861d1aa3636c2d593c13be8b7390
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          WkQC.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\WkQC.exe
                                                                          • Size 1.8MB
                                                                          • SHA256 083c7b021934991f0df091495c45273e041e04156cefb040caa3cba024706239
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          YAQM.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\YAQM.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 514213b129bc380bff842a3b2238e56280a88376841d992246a2fa6d08ae62a2
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          YMUG.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\YMUG.exe
                                                                          • Size 1.7MB
                                                                          • SHA256 537c27080d5200f4c3bb57429b4c6d984b1cfe0483e4cc84354b92cc7acc0f90
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          YQMw.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\YQMw.exe
                                                                          • Size 1.8MB
                                                                          • SHA256 839b803a8f65e0d40ba24d1f602d9b65c3ca28303c0a6eeb40ffdc260d9d6237
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          YSEQ.ico
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\YSEQ.ico
                                                                          • Size 4KB
                                                                          • SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          YYMO.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\YYMO.exe
                                                                          • Size 1.8MB
                                                                          • SHA256 eb7dbea6846076dc4d4b8f613fef8ba1e69d6ef4fe4149e32b667c4629fdd436
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          YcgY.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\YcgY.exe
                                                                          • Size 2.6MB
                                                                          • SHA256 793207273d8e5539031bb878e36098ac4524b600a7c6872bd5f6fd9fa4e83134
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          YkQa.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\YkQa.exe
                                                                          • Size 2.0MB
                                                                          • SHA256 2687a0c52a0dbcc9c4a0a4954eb0d9caefc0d2712563d7d8a294c689dab3635c
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Ysog.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Ysog.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 81f80616302e57cf26da93804e07cc518eae8cb0a93cc86541e523ecf27de6b0
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          YwQE.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\YwQE.exe
                                                                          • Size 2.2MB
                                                                          • SHA256 2f93a173b5c57b0d0cda6e9852790eef5d81e530b9879d9309081994d403d33a
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          aQkm.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\aQkm.exe
                                                                          • Size 1.8MB
                                                                          • SHA256 b3eee9a50b733a881e62096a906a846de051b3790c44a2192e3f61cc1933e30f
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          aUUw.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\aUUw.exe
                                                                          • Size 1.7MB
                                                                          • SHA256 73470d778de94261827f3f2443cfac6d1cd4544b7f150899315ad621adda637d
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          accE.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\accE.exe
                                                                          • Size 2.0MB
                                                                          • SHA256 7e78deaf9f33662987f7732b541b36acc6a38d0aa539c2fe1ce94fd2c92414e6
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          beowogEM.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\beowogEM.bat
                                                                          • Size 112B
                                                                          • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          cAIm.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\cAIm.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 bd1235bbbe51c2fe69b15f9347871c75b24f6abd2cae19e4a8cc1729d53b218a
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          cEIw.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\cEIw.exe
                                                                          • Size 1.7MB
                                                                          • SHA256 6a771c85fe95a2f35f1ad7068be225b6abb974ccefb8c5b7d93759aa06670142
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          cIQy.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\cIQy.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 23c173ff231c6609c435c367f395e5f6c5e2bb0713728901b2817e5f37ea5a96
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          cUEY.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\cUEY.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 7fb9ab6d666ea5f0a65a6bf77259c0d3674ca4c2be6850d8c0c53f3a7e9eeee7
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          cUYw.ico
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\cUYw.ico
                                                                          • Size 4KB
                                                                          • SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          cYcw.ico
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\cYcw.ico
                                                                          • Size 4KB
                                                                          • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          ccwK.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ccwK.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 4974dccb754dd661047595dd0242db53247f8d4047dfa2b1eeaac5944b945c8d
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          cgUK.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\cgUK.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 c31c9dedd969be57b744a90ad0fb165f079fa8747b21e9b34ec62dbe5a37f620
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          ckoK.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ckoK.exe
                                                                          • Size 1.8MB
                                                                          • SHA256 38083f407ed0a2f1d0b304d449677fca12ab6006d1961510c5367cee0d77bec2
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          csIC.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\csIC.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 776b64fd6b4ec58cd90278282c6cb49b7ded1794759ab890ac72ad025437f0b1
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          file.vbs
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                          • Size 19B
                                                                          • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          gQUO.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\gQUO.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 39f5e7331c9fddb8b5d5389552c466f46ce5bb5380b6593f0bf9ac012237d32f
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          gUMW.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\gUMW.exe
                                                                          • Size 1.7MB
                                                                          • SHA256 809c6af7630c2612a7e99be36967dfd6be2949b98e7364927564abe7eff753e8
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          gkke.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\gkke.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 740f8176b932d6651ebf5fb08133a245325ad0cd58a9e59f0c1a84d0789fcadc
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          gogM.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\gogM.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 86721ce35e2970eb5ee80bf50c370601c390c54fcc1b60d48bd8660bb9331dc8
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          gswG.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\gswG.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 a1af605ce3c72e5a113c0dee496084270d0eaa6e57a9460aa9acfcef9b8e8846
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          iMEQ.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\iMEQ.exe
                                                                          • Size 2.2MB
                                                                          • SHA256 c995438dd8b5af3b999cae161f61949c6c8a016b5f0d168c1ed638516f64af3f
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          iUYu.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\iUYu.exe
                                                                          • Size 2.2MB
                                                                          • SHA256 1ff15308992430feef1b1ea69d10937be087918cb0e672ee5fab4c491f9c997b
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          iUwA.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\iUwA.exe
                                                                          • Size 2.5MB
                                                                          • SHA256 b5109ad5ef4cebb505972b27c37d62fa0eeb0486ee3122e017c5d47c64cc8aa1
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          ioYs.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ioYs.exe
                                                                          • Size 2.1MB
                                                                          • SHA256 2d5b18e08b3180aa1868fd36adc48dfc3f7b5542cd5a4bf771e0f146199e36f1
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          iwUu.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\iwUu.exe
                                                                          • Size 2.3MB
                                                                          • SHA256 5dc579c21c67e7205cd587bd39b8347bc6c36eb686c89d4bac4ac97280d2359d
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          kYcM.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\kYcM.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 3a7d9c2384dcf90e5b54d5105a0f8cb7adcad231bf9ab9fd7cfbd6afdfd58835
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          kgMM.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\kgMM.exe
                                                                          • Size 1.7MB
                                                                          • SHA256 40808290979e4d4ff3d270097c5a2f97f34a48241d8949d2a2d46e51ecd28961
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          mIgO.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\mIgO.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 70a19816c251d3e2fff404c8d60bb558cd02a436a639478c86dbafe0aed39849
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          mMMI.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\mMMI.exe
                                                                          • Size 1.8MB
                                                                          • SHA256 9d61437500a70bd88bb9633414096437c4b1e7252f3f82a6bdd97f093893432e
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          mYAY.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\mYAY.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 2b871f48ef15aed10f8e65860abc4ae0097323df74a4ae81b29685efd3058289
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          mYEA.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\mYEA.exe
                                                                          • Size 1.9MB
                                                                          • SHA256 9febecb9a43985ee54c1dc950490e454a020fefa1bc05c42cffd6f18015ea9fa
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          oIke.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\oIke.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 1272ba2cb7f90d9ed9a11ff97f80842c0650875b6b14c63f54fd84112f615251
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          oMgW.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\oMgW.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 cfc639e32b29f26281656c95ebb95c9bb9c583db25129302264f6da59ed0fb41
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          oQEk.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\oQEk.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 4b9f279c2bb7b366b9a3c0b9c5372562f6fdf911d40555656ab991279baf6ed7
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          ockk.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ockk.exe
                                                                          • Size 1.9MB
                                                                          • SHA256 c79d9419e504c45863fb3f1c694f84a66e85915435dea18679cf1653eb76e659
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          ooku.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ooku.exe
                                                                          • Size 2.2MB
                                                                          • SHA256 64c4c48900ab251c00e024cba1e287bcb657a07831f88ef317abf997a3bb38e8
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          osAq.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\osAq.exe
                                                                          • Size 2.6MB
                                                                          • SHA256 0b44ad919355a06cf92ba799aef2e721b3602215533317e88532aed47553630a
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          owwO.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\owwO.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 0faf2db435dca3d50e81c85241bb23a5f321e4d1ba0c3d94f8f8ffe0593dc154
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          qEok.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\qEok.exe
                                                                          • Size 1.9MB
                                                                          • SHA256 7810fe894a0f85100dfd4368c62e3740b11f8e755317e0d797deba267fdcea86
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          qMwQ.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\qMwQ.exe
                                                                          • Size 2.8MB
                                                                          • SHA256 6292c4e86f357fa0f7b0821203c5c0f0b0cfcdd28d84af655aca3c7305a16b3a
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          qgkE.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\qgkE.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 4db826f5a37bc6fba17e5cbece0c49ec90fd2aef5a720084e1a874e245ffcd52
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          sEIe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\sEIe.exe
                                                                          • Size 2.4MB
                                                                          • SHA256 f83a4b673de8eb8dbaead8391885f06f1012694b27428e790adc401936bdc4dd
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          sIgo.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\sIgo.exe
                                                                          • Size 2.2MB
                                                                          • SHA256 f5409de43783ad9a972fa1e80272b546deb7625c1105c12b21b7a45a16005204
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          sIwm.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\sIwm.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 c918d5270ec40f9b6036c147bb8474e636cb06f06784b3fe196be8582ef45e15
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          sWIw.ico
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\sWIw.ico
                                                                          • Size 4KB
                                                                          • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          sYcA.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\sYcA.exe
                                                                          • Size 2.2MB
                                                                          • SHA256 a2e31289e4147b118d77e7ce483c7ddefb6c413ce4135cab25b4ef29014aa76d
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          scUs.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\scUs.exe
                                                                          • Size 1.7MB
                                                                          • SHA256 f9bd716d8ffce358effd997dabc200a034ac0e175aec1506069712df55870c95
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          uYAQ.ico
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\uYAQ.ico
                                                                          • Size 4KB
                                                                          • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          uYgu.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\uYgu.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 991da7499e68b348a03d90411ce382a2195db46da88b73319ce511620af3dc85
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          uoQc.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\uoQc.exe
                                                                          • Size 1.8MB
                                                                          • SHA256 667ab70df985c0e3f2e5d88e735852f5669ce9b00d96623cfd8afc2f2ef25331
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          uwIg.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\uwIg.exe
                                                                          • Size 1.9MB
                                                                          • SHA256 5a21fe2dafd454bd4cf7fc97d492ceda6645f6c56dc32183e8b43ac655886d42
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          wAYa.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\wAYa.exe
                                                                          • Size 2.0MB
                                                                          • SHA256 f0703f9ceddb5124874d6b4e3499324ffa1e095927aa8075ca822db045a9c054
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          wMUk.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\wMUk.exe
                                                                          • Size 1.9MB
                                                                          • SHA256 c686206ea1fdcbea1d08c27bb75204e8d1c038759dee36a6453a3cbab8f8be07
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          wQcI.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\wQcI.exe
                                                                          • Size 1.8MB
                                                                          • SHA256 f01dc96eeac947b04c8837aa09f2f72abcc009216b43489da7b4f39db6225ac3
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          wUQu.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\wUQu.exe
                                                                          • Size 2.2MB
                                                                          • SHA256 0d52d3175eb79c676dd9f0dce47582b645aab658f962311d35e8d3c55abcc064
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          wYMG.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\wYMG.exe
                                                                          • Size 2.0MB
                                                                          • SHA256 e7ad1bbad1978f30bdbda83952378bbbba4ed8fa14538f7d819b3e02a0578433
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          wgIs.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\wgIs.exe
                                                                          • Size 2.1MB
                                                                          • SHA256 44588202f37e4d31d57d0c113d65cd230303a95a545edd9a3ce7958dc3e576d5
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          woYE.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\woYE.exe
                                                                          • Size 1.8MB
                                                                          • SHA256 913cba347bd373ee210beb8686d8ee8f66fcf71ae4630af46f7be18abdea8392
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          yAEe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\yAEe.exe
                                                                          • Size 1.7MB
                                                                          • SHA256 649674bf01204265c6df1198d2d231f68667c603f453bfc32a1e9b8e8369f3f7
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          yEIQ.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\yEIQ.exe
                                                                          • Size 1.9MB
                                                                          • SHA256 8593eb54233c7c403dc89fbfd7a38bb2d646e580d5ad2f62f9d9da0fce92f7e0
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          ykEi.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ykEi.exe
                                                                          • Size 3.3MB
                                                                          • SHA256 baf8b53efa9146c74063548eda57abd3874b4e0a4476fdc18f842879f060d105
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          yoEE.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\yoEE.exe
                                                                          • Size 2.0MB
                                                                          • SHA256 1bec95e772ea35fe460d90760d46de19ec2977653c9eaaa52aeda75320383599
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          QmkIQokM.exe
                                                                          • Path C:\Users\Admin\gYYYgcgU\QmkIQokM.exe
                                                                          • Size 1.6MB
                                                                          • SHA256 3f661d428b2e6e10c3f11d6d2d3554ef181a19b9a10a8dc2da3321380dd345e6
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          QmkIQokM.inf
                                                                          • Path C:\Users\Admin\gYYYgcgU\QmkIQokM.inf
                                                                          • Size 4B
                                                                          • SHA256 525fe746e25a8b3b7abebc183ff364175cbb423ded9e219ad3114f610bdc3b9a
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          QmkIQokM.inf
                                                                          • Path C:\Users\Admin\gYYYgcgU\QmkIQokM.inf
                                                                          • Size 4B
                                                                          • SHA256 73ab8754fe69891cd1f1deeb909de0032364d874650f60adfda518d4cf55846b
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          QmkIQokM.inf
                                                                          • Path C:\Users\Admin\gYYYgcgU\QmkIQokM.inf
                                                                          • Size 4B
                                                                          • SHA256 77ae3e7870156af33dbe70b0ecd33d9a22a20c9eea618da3e13447ed27dfe8ec
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          QmkIQokM.inf
                                                                          • Path C:\Users\Admin\gYYYgcgU\QmkIQokM.inf
                                                                          • Size 4B
                                                                          • SHA256 fc4ae8bd7a3d61d820346b3814270d621f0ab9204e461d2360a70d7d62bc6bf8
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          memory/612-318-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/748-196-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/1504-107-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/1588-92-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/1632-363-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/1724-79-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/2036-832-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/2556-327-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/2576-2038-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                          Download

                                                                          memory/2580-256-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/2600-373-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/2668-224-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/2756-244-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/2884-2015-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                          Download

                                                                          memory/2884-14-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                          Download

                                                                          memory/2944-397-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/2944-374-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/3108-2029-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                          Download

                                                                          memory/3288-152-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/3372-181-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/3528-235-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/3740-164-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/3916-297-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/3924-306-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/4004-2010-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                          Download

                                                                          memory/4004-7-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                          Download

                                                                          memory/4012-209-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/4088-49-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/4140-287-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/4544-137-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/4680-0-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/4680-30-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/4680-31-0x0000000000B90000-0x0000000000BB0000-memory.dmp
                                                                          Download

                                                                          memory/4680-1-0x0000000000B90000-0x0000000000BB0000-memory.dmp
                                                                          Download

                                                                          memory/4760-275-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/4808-340-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/4876-354-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/4876-343-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/5236-1164-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/5276-610-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/5304-19-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                          Download

                                                                          memory/5304-2020-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                          Download

                                                                          memory/5568-731-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/5676-266-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/5732-63-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/5888-663-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download

                                                                          memory/6120-119-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                          Download