Overview

overview

10

Static

static

3

2026-08-02...ck.exe

windows10-2004-x64

10

2026-08-02...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 08:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe
  • Size 1.6MB
  • Sample260802-kv9wrazanc
  • SHA256 acfb6bc614fd5e7f2c1ed5f2e15cb76a26b6cf314f3e05c8e15644236988a4e0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 21 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 21 IoCs
    defense_evasiontrojan
  • Renames multiple (101) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 21 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 42 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 63 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4548
    • C:\Users\Admin\hQUowwEo\QcUkIssk.exe
      "C:\Users\Admin\hQUowwEo\QcUkIssk.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      PID:2500
    • C:\ProgramData\guUcAIkQ\yIEEIEsw.exe
      "C:\ProgramData\guUcAIkQ\yIEEIEsw.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:4364
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1268
      • C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3996
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5476
          • C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5700
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4732
              • C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2508
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3948
                  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4700
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:3696
                      • C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock
                        11⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:4144
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:3976
                          • C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock
                            13⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:5352
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock"
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:5944
                              • C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:260
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:3420
                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:4148
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock"
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:3160
                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock
                                        19⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2820
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock"
                                          20⤵
                                          • Executes a command shell one-liner
                                          PID:2308
                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock
                                            21⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3000
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock"
                                              22⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              PID:4188
                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe
                                                C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock
                                                23⤵
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:6112
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock"
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  PID:2472
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock
                                                    25⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:3460
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock"
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      PID:6060
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock
                                                        27⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:5148
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock"
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          PID:5372
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe
                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock
                                                            29⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:4104
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock"
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              PID:2560
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe
                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock
                                                                31⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:4568
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock"
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  PID:3848
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock
                                                                    33⤵
                                                                      PID:3188
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock"
                                                                        34⤵
                                                                        • Executes a command shell one-liner
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:4824
                                                                        • C:\Windows\System32\Conhost.exe
                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                          35⤵
                                                                            PID:4180
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock
                                                                            35⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:2548
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock"
                                                                              36⤵
                                                                              • Executes a command shell one-liner
                                                                              PID:5864
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock
                                                                                37⤵
                                                                                  PID:3208
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock"
                                                                                    38⤵
                                                                                    • Executes a command shell one-liner
                                                                                    PID:3824
                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock
                                                                                      39⤵
                                                                                        PID:4680
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock"
                                                                                          40⤵
                                                                                          • Executes a command shell one-liner
                                                                                          PID:1496
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock
                                                                                            41⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2096
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock"
                                                                                              42⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:936
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                              42⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              • Modifies registry key
                                                                                              PID:4748
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                              42⤵
                                                                                              • Modifies registry key
                                                                                              PID:5424
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                              42⤵
                                                                                              • UAC bypass
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Modifies registry key
                                                                                              PID:5960
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zYoIcsoU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe""
                                                                                              42⤵
                                                                                              • Executes a command shell one-liner
                                                                                              PID:5000
                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                43⤵
                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:2484
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                          40⤵
                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Modifies registry key
                                                                                          PID:5432
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                          40⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Modifies registry key
                                                                                          PID:3284
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                          40⤵
                                                                                          • UAC bypass
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Modifies registry key
                                                                                          PID:1224
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BkcQcEUQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe""
                                                                                          40⤵
                                                                                          • Executes a command shell one-liner
                                                                                          PID:1768
                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                            41⤵
                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                            PID:1872
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                      38⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      • Modifies registry key
                                                                                      PID:2832
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                      38⤵
                                                                                      • Modifies registry key
                                                                                      PID:1280
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                      38⤵
                                                                                      • UAC bypass
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Modifies registry key
                                                                                      PID:5972
                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                        39⤵
                                                                                          PID:900
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aSYAAock.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe""
                                                                                        38⤵
                                                                                        • Executes a command shell one-liner
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:4128
                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                          39⤵
                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:1232
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                    36⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • Modifies registry key
                                                                                    PID:6080
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                    36⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Modifies registry key
                                                                                    PID:616
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                    36⤵
                                                                                    • UAC bypass
                                                                                    • Modifies registry key
                                                                                    PID:364
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QMgEoAQI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe""
                                                                                    36⤵
                                                                                    • Executes a command shell one-liner
                                                                                    PID:1096
                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                      37⤵
                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1992
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                34⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Modifies registry key
                                                                                PID:5892
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                34⤵
                                                                                • Modifies registry key
                                                                                PID:2608
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                34⤵
                                                                                • UAC bypass
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Modifies registry key
                                                                                PID:5632
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EIYcAYoE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe""
                                                                                34⤵
                                                                                • Executes a command shell one-liner
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5592
                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                  35⤵
                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:1120
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                            32⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Modifies registry key
                                                                            PID:3304
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                            32⤵
                                                                            • Modifies registry key
                                                                            PID:2900
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                            32⤵
                                                                            • UAC bypass
                                                                            • Modifies registry key
                                                                            PID:4460
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JsAQEAsQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe""
                                                                            32⤵
                                                                            • Executes a command shell one-liner
                                                                            PID:5220
                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                              33⤵
                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                              PID:4328
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                        30⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Modifies registry key
                                                                        PID:936
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                        30⤵
                                                                        • Modifies registry key
                                                                        PID:4676
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                        30⤵
                                                                        • UAC bypass
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Modifies registry key
                                                                        PID:5424
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LeEwEkwo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe""
                                                                        30⤵
                                                                        • Executes a command shell one-liner
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:3708
                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                          31⤵
                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                          PID:2812
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                    28⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies registry key
                                                                    PID:1124
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                    28⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies registry key
                                                                    PID:1308
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                    28⤵
                                                                    • UAC bypass
                                                                    • Modifies registry key
                                                                    PID:1888
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nYAIAccg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe""
                                                                    28⤵
                                                                    • Executes a command shell one-liner
                                                                    PID:3564
                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                      29⤵
                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                      PID:5224
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                26⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Modifies registry key
                                                                PID:5056
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                26⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Modifies registry key
                                                                PID:1344
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                26⤵
                                                                • UAC bypass
                                                                • System Location Discovery: System Language Discovery
                                                                • Modifies registry key
                                                                PID:6128
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kiMIgogY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe""
                                                                26⤵
                                                                • Executes a command shell one-liner
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1860
                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                  27⤵
                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                  PID:3240
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                            24⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry key
                                                            PID:1096
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                            24⤵
                                                            • Modifies registry key
                                                            PID:5964
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                            24⤵
                                                            • UAC bypass
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry key
                                                            PID:2068
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aKcEIswE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe""
                                                            24⤵
                                                            • Executes a command shell one-liner
                                                            PID:4584
                                                            • C:\Windows\SysWOW64\cscript.exe
                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                              25⤵
                                                              • Executes a VBScript file via the Windows Script Host.
                                                              PID:1560
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                        22⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Modifies registry key
                                                        PID:3552
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                        22⤵
                                                        • Modifies registry key
                                                        PID:1180
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                        22⤵
                                                        • UAC bypass
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry key
                                                        PID:4992
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QiYgEooI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe""
                                                        22⤵
                                                        • Executes a command shell one-liner
                                                        PID:4832
                                                        • C:\Windows\SysWOW64\cscript.exe
                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                          23⤵
                                                          • Executes a VBScript file via the Windows Script Host.
                                                          PID:4960
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                    20⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Modifies registry key
                                                    PID:4444
                                                    • C:\Windows\System32\Conhost.exe
                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      21⤵
                                                        PID:1288
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                      20⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry key
                                                      PID:2344
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                      20⤵
                                                      • UAC bypass
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry key
                                                      PID:3980
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rEwocQIg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe""
                                                      20⤵
                                                      • Executes a command shell one-liner
                                                      PID:928
                                                      • C:\Windows\SysWOW64\cscript.exe
                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                        21⤵
                                                        • Executes a VBScript file via the Windows Script Host.
                                                        • System Location Discovery: System Language Discovery
                                                        PID:5504
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                  18⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Modifies registry key
                                                  PID:3272
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                  18⤵
                                                  • Modifies registry key
                                                  PID:5984
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                  18⤵
                                                  • UAC bypass
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry key
                                                  PID:5524
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vYocwIUI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe""
                                                  18⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4240
                                                  • C:\Windows\SysWOW64\cscript.exe
                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                    19⤵
                                                    • Executes a VBScript file via the Windows Script Host.
                                                    PID:2416
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                              16⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry key
                                              PID:5876
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                              16⤵
                                              • Modifies registry key
                                              PID:5972
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                              16⤵
                                              • UAC bypass
                                              • Modifies registry key
                                              PID:2184
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nEcMAEIY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe""
                                              16⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:3356
                                              • C:\Windows\SysWOW64\cscript.exe
                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                17⤵
                                                • Executes a VBScript file via the Windows Script Host.
                                                PID:900
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                          14⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Modifies registry key
                                          PID:5036
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                          14⤵
                                          • Modifies registry key
                                          PID:5544
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                          14⤵
                                          • UAC bypass
                                          • Modifies registry key
                                          PID:6060
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EkUUUoYw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe""
                                          14⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:4132
                                          • C:\Windows\SysWOW64\cscript.exe
                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                            15⤵
                                            • Executes a VBScript file via the Windows Script Host.
                                            • System Location Discovery: System Language Discovery
                                            PID:4104
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                      12⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry key
                                      PID:1096
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                      12⤵
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry key
                                      PID:3460
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                      12⤵
                                      • UAC bypass
                                      • Modifies registry key
                                      PID:3724
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iWEMQksI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe""
                                      12⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:5440
                                      • C:\Windows\SysWOW64\cscript.exe
                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                        13⤵
                                        • Executes a VBScript file via the Windows Script Host.
                                        PID:3136
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                  10⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry key
                                  PID:2716
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                  10⤵
                                  • Modifies registry key
                                  PID:2948
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                  10⤵
                                  • UAC bypass
                                  • Modifies registry key
                                  PID:3320
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BOwUgcQE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe""
                                  10⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:2120
                                  • C:\Windows\SysWOW64\cscript.exe
                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                    11⤵
                                    • Executes a VBScript file via the Windows Script Host.
                                    PID:4180
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              • System Location Discovery: System Language Discovery
                              • Modifies registry key
                              PID:1288
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                              8⤵
                              • System Location Discovery: System Language Discovery
                              • Modifies registry key
                              PID:840
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                              8⤵
                              • UAC bypass
                              • Modifies registry key
                              PID:932
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jOsUIQgs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe""
                              8⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:1240
                              • C:\Windows\SysWOW64\cscript.exe
                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                9⤵
                                • Executes a VBScript file via the Windows Script Host.
                                PID:1180
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                          6⤵
                          • Modifies visibility of file extensions in Explorer
                          • Modifies registry key
                          PID:5260
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                          6⤵
                          • System Location Discovery: System Language Discovery
                          • Modifies registry key
                          PID:3284
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                          6⤵
                          • UAC bypass
                          • Modifies registry key
                          PID:4776
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rScIEkcs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe""
                          6⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:2568
                          • C:\Windows\SysWOW64\cscript.exe
                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                            7⤵
                            • Executes a VBScript file via the Windows Script Host.
                            • System Location Discovery: System Language Discovery
                            PID:936
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                      4⤵
                      • Modifies visibility of file extensions in Explorer
                      • System Location Discovery: System Language Discovery
                      • Modifies registry key
                      PID:2736
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                      4⤵
                      • System Location Discovery: System Language Discovery
                      • Modifies registry key
                      PID:3908
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                      4⤵
                      • UAC bypass
                      • Modifies registry key
                      PID:4128
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tekIEQYE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe""
                      4⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:1208
                      • C:\Windows\SysWOW64\cscript.exe
                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                        5⤵
                        • Executes a VBScript file via the Windows Script Host.
                        PID:4472
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                  2⤵
                  • Modifies visibility of file extensions in Explorer
                  • Modifies registry key
                  PID:5520
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                  2⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry key
                  PID:3800
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                  2⤵
                  • UAC bypass
                  • Modifies registry key
                  PID:6060
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\teAkgMYY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock.exe""
                  2⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3756
                  • C:\Windows\SysWOW64\cscript.exe
                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                    3⤵
                    • Executes a VBScript file via the Windows Script Host.
                    • System Location Discovery: System Language Discovery
                    PID:3228
              • C:\ProgramData\hWooIkAY\yQwAMAko.exe
                C:\ProgramData\hWooIkAY\yQwAMAko.exe
                1⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in System32 directory
                PID:5580
              • C:\Users\Admin\hQUowwEo\QcUkIssk.exe
                C:\Users\Admin\hQUowwEo\QcUkIssk.exe
                1⤵
                • Executes dropped EXE
                • Adds Run key to start application
                PID:3832
              • C:\ProgramData\guUcAIkQ\yIEEIEsw.exe
                C:\ProgramData\guUcAIkQ\yIEEIEsw.exe
                1⤵
                • Executes dropped EXE
                • Adds Run key to start application
                PID:3972
              • C:\Windows\system32\DllHost.exe
                C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                1⤵
                  PID:1280
                • C:\Windows\System32\sihclient.exe
                  C:\Windows\System32\sihclient.exe /cv D4LJaLmjQUCU2TjYXJXMiQ.0.2
                  1⤵
                    PID:5876

                  Network

                        MITRE ATT&CK Enterprise v16

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        2
                        T1059

                        Visual Basic

                        1
                        T1059.005

                        Windows Command Shell

                        1
                        T1059.003

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Privilege Escalation

                        Abuse Elevation Control Mechanism

                        1
                        T1548

                        Bypass User Account Control

                        1
                        T1548.002

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Defense Evasion

                        Abuse Elevation Control Mechanism

                        1
                        T1548

                        Bypass User Account Control

                        1
                        T1548.002

                        Hide Artifacts

                        1
                        T1564

                        Hidden Files and Directories

                        1
                        T1564.001

                        Impair Defenses

                        1
                        T1562

                        Disable or Modify Tools

                        1
                        T1562.001

                        Modify Registry

                        4
                        T1112

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Unsecured Credentials

                        1
                        T1552

                        Credentials In Files

                        1
                        T1552.001

                        Discovery

                        System Information Discovery

                        1
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        Lateral Movement

                        Collection

                        Data from Local System

                        1
                        T1005

                        Command and Control

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        AsQQ.txt
                        • Path C:\ProgramData\AsQQ.txt
                        • Size 8KB
                        • SHA256 c56d839221d79822462865490e9d186577c218389049400db8fee8de12256848
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        yIEEIEsw.exe
                        • Path C:\ProgramData\guUcAIkQ\yIEEIEsw.exe
                        • Size 1.6MB
                        • SHA256 e2037749091011fd9cdff69eb3f55e8839902b43f61b6012eab41c2e5c90a246
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        yIEEIEsw.inf
                        • Path C:\ProgramData\guUcAIkQ\yIEEIEsw.inf
                        • Size 4B
                        • SHA256 b0f110596cf1386e82b514f701cde1bf058b41f235af457844ce700df0e07b2f
                        • MD5 SHA1 SHA512
                        Submit Download

                        yIEEIEsw.inf
                        • Path C:\ProgramData\guUcAIkQ\yIEEIEsw.inf
                        • Size 4B
                        • SHA256 39e249a9de995ab2200e846439419cab41e4dd0eafdb82097440a5e73716dd97
                        • MD5 SHA1 SHA512
                        Submit Download

                        yQwAMAko.exe
                        • Path C:\ProgramData\hWooIkAY\yQwAMAko.exe
                        • Size 1.6MB
                        • SHA256 f423cc5b6379394415d258ecd53e7b5c0c874c27161814689de58c173b41e9b4
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock
                        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-02_30f1984bedeea092073b51698d7bd544_elex_virlock
                        • Size 28KB
                        • SHA256 5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        AQgO.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\AQgO.exe
                        • Size 2.2MB
                        • SHA256 1e9da9e98948449292a2c38cd413d83aa54a6c858d7c4213a4bc10cb2baf02e9
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        AUse.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\AUse.exe
                        • Size 1.6MB
                        • SHA256 91f81fdc27781a78db77e7ddeb80a98b0e9e285376f78554ee52eddc192cdaa9
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        AgIY.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\AgIY.exe
                        • Size 1.6MB
                        • SHA256 eaf0395220f1d4aacc8812092fa0311d93032d133d991d9de399a787a7fbf838
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        AsAm.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\AsAm.exe
                        • Size 1.6MB
                        • SHA256 c66b5bc4b0ec54b03b3ceadf838d32126994317dbeadc2d0e4d7c06f98a14aa7
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        CIEy.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\CIEy.exe
                        • Size 1.6MB
                        • SHA256 21d4a4608a378d5e46005d40d23e749cb1e215b57005b2105be6e8cc2cf2766a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        CMkS.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\CMkS.exe
                        • Size 2.0MB
                        • SHA256 3b151f04ee9642cf5acdaf03559d1f83656cd43db1c35d827ab3134e9f86c518
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        CQMq.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\CQMq.exe
                        • Size 1.6MB
                        • SHA256 8f62bcd375d4016f7b6c51fa82bb8a4a63c958fb1932cf4f00cf691c26bba21d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        CYME.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\CYME.exe
                        • Size 2.1MB
                        • SHA256 2717f20d809ad0f5c78225e52ad1094dca353a307eeca2507fd82431d8f1b965
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        CYMa.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\CYMa.exe
                        • Size 1.6MB
                        • SHA256 ba9088835f73fd584cf842fa9885ae3c0dd9c0b1c7ffe363f5c7d48dd1222e8c
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        CgIA.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\CgIA.exe
                        • Size 1.9MB
                        • SHA256 6a4605a7f3474be4c365e78728fc3d1da97dacd94710d0592d928d6e42f22fcc
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        CgIq.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\CgIq.exe
                        • Size 1.6MB
                        • SHA256 dcebe16142cc55c3c798461df8237b8a02230264601ca8cce67b3fa636eebca1
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Ckcc.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\Ckcc.exe
                        • Size 2.0MB
                        • SHA256 d6adb811cab4995fdd82daeec766f9349aa137479b80bdbf84050a8c8f753edb
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Cogu.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\Cogu.exe
                        • Size 2.1MB
                        • SHA256 0a0655bb7ad2328261aa074154bf60e64a1d31e6f0fc82e45d9f871cfa53734c
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        CsEi.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\CsEi.exe
                        • Size 2.3MB
                        • SHA256 62f573271557a6a7579acdb49f5fc3eb9adf3bba7e1a2bab9b70a7ce26a59135
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        EEYk.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\EEYk.exe
                        • Size 2.1MB
                        • SHA256 405cfffdcb089998dae55e2d5bd2e80716e72f4573fa1f95de03a91a269638bd
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        EQQE.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\EQQE.exe
                        • Size 2.0MB
                        • SHA256 cc8af0ebd951045ce7137cc8f6f4814eb5b8d4ad391bd12de89bd95adac2305d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        EUAK.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\EUAK.exe
                        • Size 1.6MB
                        • SHA256 f2b22076cc0d99367b2cfa7244c34da59514f46a28f254d1e903ef64fd606297
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        EoIS.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\EoIS.exe
                        • Size 1.8MB
                        • SHA256 1b9cb8e0fc7e62c0611412548ff0ff0b86997e13d95951d8344959d259815338
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        GAgU.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\GAgU.exe
                        • Size 1.6MB
                        • SHA256 287ebbc5985e6a706df519fdf30e302c2984486bfdf1fc0ffefe07753e145091
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        GEAA.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\GEAA.exe
                        • Size 1.6MB
                        • SHA256 b14566bbed262a22319147ecb9de54f7929324b6874dd45a0cedb897318ee0a0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        GMAG.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\GMAG.exe
                        • Size 1.6MB
                        • SHA256 7e3680bbcbd9e98543bb3c68f42f3e3f001b502dca2ec6798b18e0590b4bbe54
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        GgQG.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\GgQG.exe
                        • Size 1.6MB
                        • SHA256 1c6b311cc61f0496d7414aa8665238e030d6c97f95edfec6468e3b818e7ae48b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        GoIo.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\GoIo.exe
                        • Size 1.8MB
                        • SHA256 12c0eb71f3fc322633714ca85e275bdad208b68a581d570a7242384c2a023a0d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        IAUY.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\IAUY.exe
                        • Size 2.1MB
                        • SHA256 fc8b9e06c3dd6676ca7d0caa7800d04782b884af60ab3a6e9e77c656b65ac1b4
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        IYQc.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\IYQc.exe
                        • Size 1.9MB
                        • SHA256 ab49fd1e750bce61dd5c286b75cb57d77254bd5d18749eeed808deff94be6266
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        IgEq.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\IgEq.exe
                        • Size 2.1MB
                        • SHA256 1bf43d9a9f64996710dd67fa07b42a72f6fa9dea675fb1079a978da3a29360c7
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        IoQy.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\IoQy.exe
                        • Size 2.0MB
                        • SHA256 98769e52edd1d3546f9f219be45faf1afa22e923bc3de78e8cd55680d252f729
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        IsUI.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\IsUI.exe
                        • Size 2.6MB
                        • SHA256 57336d1dca045528fad0cd7b8bde1f3a9eefce6e25bae24d2ab5dbf93c043c83
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        KAMs.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\KAMs.exe
                        • Size 2.1MB
                        • SHA256 f12c14713896fd77ee21c45429f55173b7fc009196f1c35764b30ae25086abc3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        MIce.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\MIce.exe
                        • Size 2.0MB
                        • SHA256 f846736a47e39042abaaa2a1b82d9b331358c5a2441e8a6d225cd3955f73629d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        MgcU.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\MgcU.exe
                        • Size 1.6MB
                        • SHA256 4c17c5fdacd0ef9c9fa87c3baef19d13e5f6f9ac5a4d3c30d1db23145cf9772d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        MwAQ.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\MwAQ.ico
                        • Size 4KB
                        • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        OAAu.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\OAAu.exe
                        • Size 1.8MB
                        • SHA256 c60866673c75326bc4c71433e4b0183fbabba50035430e5e9e8c48cd558f88bd
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        OAUG.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\OAUG.exe
                        • Size 2.0MB
                        • SHA256 1f92a9dcaa3dec5a6d9cdd0ad284fc91a4be40809618b44c1d1af4fecd479579
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        OsIC.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\OsIC.exe
                        • Size 1.6MB
                        • SHA256 6625f408ad964ced1a4588e2ebd4e82da3cb4eb3c036330df0654357ca366729
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        OwsE.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\OwsE.exe
                        • Size 2.3MB
                        • SHA256 a70c44e25b4e4e01987f9cb46a835f0eb276a568f0cfe885a9d90da01da8cb5f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        QMkg.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\QMkg.exe
                        • Size 1.6MB
                        • SHA256 a2e84f5990c621bdba07ae86ac2654aa39cc2f95b265e90b4bef9fc5b50ce353
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        QUQI.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\QUQI.exe
                        • Size 2.0MB
                        • SHA256 2a010464d88d34f2e236cd502faf44838af0fdeac8a3cc5ed6e85c8dbd968e35
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        QgkK.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\QgkK.exe
                        • Size 1.7MB
                        • SHA256 f772e2c4caf7369f944ea58c429abb396461ce6b53f2315c80861b4418da6545
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Qwog.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\Qwog.exe
                        • Size 2.2MB
                        • SHA256 f686b389a46acffcc7f30a35de505768022240fc77312ef227e56f554aef1f0c
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        SMgA.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\SMgA.exe
                        • Size 1.7MB
                        • SHA256 5db0a6de6a83c784be6684eda342b801ca643b1fb00d83a97d2bef23233d166b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        SUki.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\SUki.exe
                        • Size 1.9MB
                        • SHA256 11544815ea3e45ec4055c568eed2800daa0be8a43af569b6835fc90a07c55352
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        SUky.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\SUky.exe
                        • Size 1.8MB
                        • SHA256 4ce8acde2b4dfd1d657a69126b9edebf15f458fe0b2d34ab47b3f1236f1abe47
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        SUsA.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\SUsA.exe
                        • Size 1.6MB
                        • SHA256 d1ef026d98c3e9f631b6c552f6d0f7e7543e7e9e1ebb888f7aa6f901fe91f607
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        SgUq.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\SgUq.exe
                        • Size 1.6MB
                        • SHA256 d7a7f63ac33a2483272f83871fd22f25caae4a7ef25b9d33d3a3413531a99644
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        SgUq.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\SgUq.exe
                        • Size 1.7MB
                        • SHA256 0a67503e95aab7e1cd33e092ffe3a22e2ac05faa4163a2b7d9d2f870a51239fa
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        SkcA.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\SkcA.exe
                        • Size 2.0MB
                        • SHA256 88468319388562cb31f1190f5981574b0566bd79224d96d70aaf4e42a2107a90
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        UAMA.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\UAMA.exe
                        • Size 1.9MB
                        • SHA256 551efbc69466af7cd67495cef86bd35b6adde02e2c204a1fbf29542308ef5d9e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        UMwA.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\UMwA.ico
                        • Size 4KB
                        • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        UgUM.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\UgUM.exe
                        • Size 1.6MB
                        • SHA256 8b06bdee33cc0e4b05eb4508bd040c9108a3e27583615b2ba52ae2a87188f60a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        UoEO.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\UoEO.exe
                        • Size 1.8MB
                        • SHA256 cb865bd2ab47ae2351a3a1983c96aefaba98be7563ab9177bed0b7c1de2a0679
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        UwQC.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\UwQC.exe
                        • Size 2.7MB
                        • SHA256 e56c286908968d2e762de5af58cbbe94ac283622a10850475229298aae886f83
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        WEAa.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\WEAa.exe
                        • Size 1.6MB
                        • SHA256 6c8310f7715e2cd142a5acdff6d51f4dce47c0baa259b3e67aaca0ed778fa77b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        WIEA.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\WIEA.exe
                        • Size 1.6MB
                        • SHA256 29a832a2a096392a47c2826d6b40b4f111e1bd0ab34809091becba08a3dfce6e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        WIEu.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\WIEu.exe
                        • Size 1.6MB
                        • SHA256 99bd43852dd882997a7248bca5b8f46ce6faabb415c9df3b0a0a9b20e10f7233
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        WUMC.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\WUMC.exe
                        • Size 1.6MB
                        • SHA256 5089e0266405b1ba4a30122311449a8e4cd9f38f98aa8b687a630ad3f0d9a6da
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        WiQQ.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\WiQQ.ico
                        • Size 4KB
                        • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        YIoG.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\YIoG.exe
                        • Size 1.6MB
                        • SHA256 4cea63b03f211035f990a089e14a1f8e886d06f91b58cfe89c26eb501283cc49
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        YWQM.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\YWQM.ico
                        • Size 4KB
                        • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        YkMw.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\YkMw.exe
                        • Size 2.1MB
                        • SHA256 b7918e917da721d95d9d9aba1beff6703cd22384a39f954e9a39d0a81f02ab8f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        YksI.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\YksI.exe
                        • Size 1.8MB
                        • SHA256 2b3515a4d6b8077af7ccfa76af9d877d5c905469c7b9188b5d41f73a3c041fd3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        aAIY.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\aAIY.exe
                        • Size 1.6MB
                        • SHA256 9f6faf001a31605e52fb567690f8e9af57d728bd636edca0b2e198ce8d21f71a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        aQcq.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\aQcq.exe
                        • Size 1.6MB
                        • SHA256 8813a485a99ae647899619ecf66a0b2c2be0964d9c53f5d067d3e5a913bb279f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        aUwS.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\aUwS.exe
                        • Size 2.1MB
                        • SHA256 a9f53cda77186d38836c1d4a587b1722fd38262a79b7084be50a325f3ff043a9
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        acAy.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\acAy.exe
                        • Size 1.8MB
                        • SHA256 5a96a6b084ce202e22e8476610356d292c06cec38c366810c534425cefe7667f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        auIQ.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\auIQ.ico
                        • Size 4KB
                        • SHA256 bc4ed7d844af9da0a5d2fe12e8db07fbfdf6e0ecd557223b292bd0e9cb6a64a1
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        cEwq.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\cEwq.exe
                        • Size 1.6MB
                        • SHA256 3176c668ab846697066a0c9641e889859525f226db3bfbd37d02a982d3e97eb8
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        cMwy.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\cMwy.exe
                        • Size 1.6MB
                        • SHA256 818624438131b24d3b2d67a6a5205bcb1e94d9b6c944bab4be30ed090742af4d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        cUoK.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\cUoK.exe
                        • Size 1.6MB
                        • SHA256 e57c97236ade760ab74a225c2c74a59b009bb8f378b4c175e97c9905886b615a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        coAm.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\coAm.exe
                        • Size 2.2MB
                        • SHA256 d775b9cf940fe3a18b77b7d62f6569cda460dbd1598e64d72a5b8c067a5b433a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        eIUY.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\eIUY.exe
                        • Size 1.9MB
                        • SHA256 b112c62a24510e1c45785bfda1309b41e9813b5d691733fe5948476dd079dae5
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        eQwS.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\eQwS.exe
                        • Size 2.4MB
                        • SHA256 8d70dff6858c8a94f19f77d7b43b8f2c83dbfa52c5078eecf62d49e581d162fb
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        eScM.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\eScM.ico
                        • Size 4KB
                        • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ekoY.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\ekoY.exe
                        • Size 1.8MB
                        • SHA256 d62b2ffe0966af5b4bc4478fb9de7a7ce73d3514a74bd5bf0ec62e40edd7d487
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        eoUQ.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\eoUQ.exe
                        • Size 1.9MB
                        • SHA256 4d765bbd9a221de81ddb1842a977b2193b0b115f38713b8e9410e761939728d6
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        file.vbs
                        • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                        • Size 19B
                        • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                        • MD5 SHA1 SHA512
                        Submit Download

                        gAce.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\gAce.exe
                        • Size 2.2MB
                        • SHA256 e54d8ba1409e865ab0c4e8fef826641255742602b7d27ae24ed87cc245958dbd
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        gEcY.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\gEcY.exe
                        • Size 2.0MB
                        • SHA256 ef2e5bf0ec142a9b64c8e9cecb4d2169551421f3f18f9a9d7236d2e8c9932add
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        gMwG.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\gMwG.exe
                        • Size 1.6MB
                        • SHA256 8e8a66d74918417681c3d3e7ec5aac114675f14e4bb2a4e0ba9809c8f36cdc77
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        gkYW.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\gkYW.exe
                        • Size 1.6MB
                        • SHA256 4d650cd731fce854db5f2454f672497b0cfa25a0a32d4f7fc407bfb4bf171949
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        goMI.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\goMI.exe
                        • Size 1.9MB
                        • SHA256 88e377c0692d66942a64a3da38ad39796edc1f782fad18889151d334e20f2579
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        gswu.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\gswu.exe
                        • Size 2.7MB
                        • SHA256 9007636f45065af733f945e54367a79e254a841e584cb6b59802c5ff35e402ab
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        gwgE.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\gwgE.exe
                        • Size 1.6MB
                        • SHA256 020638eb657a82ebb8f8f70fff0dfa384dc8b932995bb85deb343c988c28280b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        gwgs.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\gwgs.exe
                        • Size 1.9MB
                        • SHA256 ddb3de29ae0f42d1695acdd691a65b3e1c3a2e0d153d0e437acb2304836d3ec6
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        iEky.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\iEky.exe
                        • Size 1.7MB
                        • SHA256 dbe86a3190b73e0fdaf2a90d5656cbf8dceb6d8742b75cb56eff03e665e00c0d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        iQEM.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\iQEM.exe
                        • Size 2.2MB
                        • SHA256 e30f3dd32423bee61028f2eafa94c18b91e71d489021e78de81a986976f901a1
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        icoe.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\icoe.exe
                        • Size 1.6MB
                        • SHA256 040d84457fe3ebba9a4eb43a0f1a87043c8500de7c9d69e16711027ad6bc4690
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        igYw.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\igYw.exe
                        • Size 1.7MB
                        • SHA256 558712b014723704c02975994e070162261b4ce32c8bbc7eac62f9cd9c9d338a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ikcQ.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\ikcQ.exe
                        • Size 2.5MB
                        • SHA256 8e7754b2ce61b4898f5a2ac0d2b097b917c06980c50caab085345c6815a4980f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ioUg.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\ioUg.exe
                        • Size 2.1MB
                        • SHA256 43637cf435e9e999354893ea6abb7ac655853fb618489966fe6ffa43bcdd412a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ioUo.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\ioUo.exe
                        • Size 1.6MB
                        • SHA256 1459defddca0ada5a110e6984813743d7aa01ad6d4d066a7a515da30c9e7cc73
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        kMkc.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\kMkc.exe
                        • Size 1.8MB
                        • SHA256 001d5683224801c541570941cf6fea6e028c422f9925a3ca1a5482da37b6c5a7
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        kUIM.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\kUIM.ico
                        • Size 4KB
                        • SHA256 114dae4c54ca426f78e50998727dac92942261d71ca5b2dbaf413794dcf8ad82
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        kYUA.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\kYUA.exe
                        • Size 1.7MB
                        • SHA256 ac102bf7bf610b80cc838290d2b84ad359852ba127608e27d9ba6978f0a4cedd
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        kYka.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\kYka.exe
                        • Size 1.6MB
                        • SHA256 b84c4b30c64df2a5101dcb6f7c0d27e1dd18f02ab547cf713073724ee57a26b0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        kaUg.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\kaUg.ico
                        • Size 4KB
                        • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ksQk.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\ksQk.exe
                        • Size 1.6MB
                        • SHA256 6a844cd76c90fbf3d49fd46dbfe61081c4e1ba83ed090636cd55186b9a4e8194
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ksYg.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\ksYg.exe
                        • Size 1.6MB
                        • SHA256 01b2c10c4b23e824e02b51a47d2d53ab55fc9b342e7c77dcb0853c6df2fc97d0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        mEsk.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\mEsk.exe
                        • Size 2.2MB
                        • SHA256 fc311cb282329581ed64337fbbfd58aa51ce0b0d2a450e1e5ba2b79d36294116
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        mUUi.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\mUUi.exe
                        • Size 2.0MB
                        • SHA256 815042342e02f5e9a4709c6166960772c9ba0227fb4b1abd44d84b4f34872b1a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        mUgi.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\mUgi.exe
                        • Size 2.2MB
                        • SHA256 ccb56dd533891a8e0b19a213009fec5ff9a5e818ac8b8a5ebaaaca273ca0445f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        mosa.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\mosa.exe
                        • Size 2.0MB
                        • SHA256 c29095267a0582d6f55d0ce1bcac12c60e2274a62826c170c20214652de010bc
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        myIE.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\myIE.ico
                        • Size 4KB
                        • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        oEUC.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\oEUC.exe
                        • Size 1.6MB
                        • SHA256 d5aa684c3e188ac4db9602de72945804dbe2eb05c6d88e958f5e8e5eb97084ff
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        oEYi.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\oEYi.exe
                        • Size 1.8MB
                        • SHA256 803839434333777d17c1c0f29d53c6187e21632987e0e4d7472a1eff61145766
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        oIAW.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\oIAW.exe
                        • Size 1.8MB
                        • SHA256 39901f435f8711b46225d09ecce6df52f99389436690ba614074ba9bcb15d596
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        oMgu.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\oMgu.exe
                        • Size 2.0MB
                        • SHA256 40446e5e0fb1e07347c318ef181a35e5bd056cf522464dc622c1cf2ee1ef6309
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ogku.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\ogku.exe
                        • Size 2.0MB
                        • SHA256 726a3bdb08023c6f30c6c095c61134780c9bcb19a9b2163b493da124153ff64c
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        owUG.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\owUG.exe
                        • Size 2.0MB
                        • SHA256 8553031ee9e3526b224ad3a99387c0d3fc6bc97d779b558ff7ff086aaf12b502
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        qEsS.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\qEsS.exe
                        • Size 3.1MB
                        • SHA256 9f25831fca5557f899b5ade4fd65c52ec862a7f7e2d332709ed1d944747f9f95
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        qUMG.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\qUMG.exe
                        • Size 1.7MB
                        • SHA256 a8f48344846f3b43ced1031a5e3630d19fb34a41823ea8abb65327ebcde4c696
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        qUkc.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\qUkc.exe
                        • Size 1.8MB
                        • SHA256 9f84f362eef31afadfb670b4b1d21881ff02de858406839670fbd0ea2d3381d8
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        qUwc.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\qUwc.exe
                        • Size 1.8MB
                        • SHA256 0511376482d490abda3f832388a2bcf241bbd318e2e9f85d81cb95feb7477b43
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        qcEo.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\qcEo.exe
                        • Size 2.2MB
                        • SHA256 a951a6ce85b81461a78a69f931eedfadf4dc023729d7b439ef4867498885dd91
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        qkUi.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\qkUi.exe
                        • Size 2.2MB
                        • SHA256 5dcf50a2c57745e66fc364c3b930f9d126b5dee0dd6f4484750da1dd57ea6ec1
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        skkg.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\skkg.exe
                        • Size 2.4MB
                        • SHA256 0975060bac3b6839ded593f33df18e00dcfbd748bc9dc28d213afcc490a27ae7
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        sooI.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\sooI.exe
                        • Size 1.8MB
                        • SHA256 5fbfe58c28da32e10f620bd9921d12bc539df8bb54380a6fb4c671954121885e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        swME.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\swME.exe
                        • Size 2.0MB
                        • SHA256 dedb7b51234f3cfb284f61045d4f612a53a3bab71e5c5e9bcf2a12342675fcfc
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        teAkgMYY.bat
                        • Path C:\Users\Admin\AppData\Local\Temp\teAkgMYY.bat
                        • Size 112B
                        • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        uYsU.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\uYsU.exe
                        • Size 1.6MB
                        • SHA256 289a9a57454aceb74b9fad3d0cd0ab44d8f7c1076a7ae7cfa611f0939fe17f8d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ukco.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\ukco.exe
                        • Size 1.6MB
                        • SHA256 68ef2ac7f7990182492c6e1bfd8cbe972a0ef3c5266b5a88495b9a0866846eba
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ussG.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\ussG.exe
                        • Size 1.8MB
                        • SHA256 ac282f59d5314cd2871443d5ba3ac09c49825afb5f84102e6fb12605639a4dd1
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        wAkO.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\wAkO.exe
                        • Size 3.1MB
                        • SHA256 ba43ee4e551e6fd4e0cb4f74524af003b55a867a982c9eca5670342157979a0e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        wEQs.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\wEQs.exe
                        • Size 2.6MB
                        • SHA256 b7ad4ecdba27949a0aea15e8d51e7c21ef56b1866a22dbdeee59528997c0e008
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        wEUa.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\wEUa.exe
                        • Size 2.6MB
                        • SHA256 7cdc55c68d8c58cefe36374c019c6aa90707795caa1a62ac0671ea4a908202ab
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        wUAW.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\wUAW.exe
                        • Size 2.1MB
                        • SHA256 5f8d2f4334826d5deb3ac889350147f22e26ccd9662c5dd943a4b72485fa7090
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        wUAo.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\wUAo.exe
                        • Size 1.6MB
                        • SHA256 2af5d9bdd86d11369e2b98033fd5be6eb495d3737b41d03b7892154887285100
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        wgoA.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\wgoA.ico
                        • Size 4KB
                        • SHA256 9a233711400b52fc399d16bb7e3937772c44d7841a24a685467e19dfa57769d5
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        woAQ.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\woAQ.exe
                        • Size 2.2MB
                        • SHA256 182416f73e93eb2f0ff2f18441ccd8183a391a0ccf12cd2c61b3263fa85cccd7
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        wosy.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\wosy.exe
                        • Size 2.0MB
                        • SHA256 48c2a5bc699cfa81bdb6b09dca747ff80f9da33911f8ed9f4f3480028ad924b2
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        wwko.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\wwko.exe
                        • Size 1.9MB
                        • SHA256 85d936126f0e200f997f7d7bb3e763e04a81d1e5b39f53d2ee7665a03fcd80cd
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        yIgI.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\yIgI.ico
                        • Size 4KB
                        • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ywMw.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\ywMw.exe
                        • Size 2.2MB
                        • SHA256 b401061b2227209f8b770d689cfa700a84a3106c5e92c1b2db91483dfcf24afe
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ywUA.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\ywUA.exe
                        • Size 2.1MB
                        • SHA256 e2aa4e7683b31761392f466660cb3bf4b10518ee009f38f3550fa0d23f1abd3a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        QcUkIssk.exe
                        • Path C:\Users\Admin\hQUowwEo\QcUkIssk.exe
                        • Size 1.6MB
                        • SHA256 c0d1b8ec7fa71650eae9fdfb0ababe5f3373d55ccea823f388b8487eb8e71fa4
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        QcUkIssk.inf
                        • Path C:\Users\Admin\hQUowwEo\QcUkIssk.inf
                        • Size 4B
                        • SHA256 141470eedafd5662470a1e7fd0befe2ff17a125f51b2ce76770c9bf6c919efbf
                        • MD5 SHA1 SHA512
                        Submit Download

                        QcUkIssk.inf
                        • Path C:\Users\Admin\hQUowwEo\QcUkIssk.inf
                        • Size 4B
                        • SHA256 461bce03c5f76ad9bf631de1ba41ed5ddec79d2f0031e0fa712df99e8a76f351
                        • MD5 SHA1 SHA512
                        Submit Download

                        QcUkIssk.inf
                        • Path C:\Users\Admin\hQUowwEo\QcUkIssk.inf
                        • Size 4B
                        • SHA256 33bb9f736599dfedddfb8b9c23270baee985e1ccecf2be7d2b0faf8281ada208
                        • MD5 SHA1 SHA512
                        Submit Download

                        QcUkIssk.inf
                        • Path C:\Users\Admin\hQUowwEo\QcUkIssk.inf
                        • Size 4B
                        • SHA256 4481c3c1ea8e055b34f56f08b29314a5bff45e72125f0cd51e5337b639a082e5
                        • MD5 SHA1 SHA512
                        Submit Download

                        memory/260-138-0x0000000000400000-0x0000000000598000-memory.dmp
                        Download

                        memory/2096-302-0x0000000000400000-0x0000000000598000-memory.dmp
                        Download

                        memory/2500-307-0x00000000021E0000-0x0000000002200000-memory.dmp
                        Download

                        memory/2500-1919-0x0000000000400000-0x0000000000590000-memory.dmp
                        Download

                        memory/2500-7-0x0000000000400000-0x0000000000590000-memory.dmp
                        Download

                        memory/2500-1743-0x00000000021E0000-0x0000000002200000-memory.dmp
                        Download

                        memory/2508-82-0x0000000000400000-0x0000000000598000-memory.dmp
                        Download

                        memory/2548-268-0x0000000000400000-0x0000000000598000-memory.dmp
                        Download

                        memory/2820-172-0x0000000000400000-0x0000000000598000-memory.dmp
                        Download

                        memory/3000-185-0x0000000000400000-0x0000000000598000-memory.dmp
                        Download

                        memory/3188-258-0x0000000000400000-0x0000000000598000-memory.dmp
                        Download

                        memory/3208-280-0x0000000000400000-0x0000000000598000-memory.dmp
                        Download

                        memory/3460-216-0x0000000000400000-0x0000000000598000-memory.dmp
                        Download

                        memory/3832-1934-0x0000000000400000-0x0000000000590000-memory.dmp
                        Download

                        memory/3972-1939-0x0000000000400000-0x0000000000590000-memory.dmp
                        Download

                        memory/3996-52-0x0000000000400000-0x0000000000598000-memory.dmp
                        Download

                        memory/4104-237-0x0000000000400000-0x0000000000598000-memory.dmp
                        Download

                        memory/4144-110-0x0000000000400000-0x0000000000598000-memory.dmp
                        Download

                        memory/4148-156-0x0000000000400000-0x0000000000598000-memory.dmp
                        Download

                        memory/4364-1924-0x0000000000400000-0x0000000000590000-memory.dmp
                        Download

                        memory/4364-17-0x0000000000400000-0x0000000000590000-memory.dmp
                        Download

                        memory/4548-1-0x0000000002230000-0x0000000002250000-memory.dmp
                        Download

                        memory/4548-31-0x0000000000400000-0x0000000000598000-memory.dmp
                        Download

                        memory/4548-32-0x0000000002230000-0x0000000002250000-memory.dmp
                        Download

                        memory/4548-0-0x0000000000400000-0x0000000000598000-memory.dmp
                        Download

                        memory/4568-248-0x0000000000400000-0x0000000000598000-memory.dmp
                        Download

                        memory/4680-290-0x0000000000400000-0x0000000000598000-memory.dmp
                        Download

                        memory/4680-279-0x0000000000400000-0x0000000000598000-memory.dmp
                        Download

                        memory/4700-93-0x0000000000400000-0x0000000000598000-memory.dmp
                        Download

                        memory/5148-226-0x0000000000400000-0x0000000000598000-memory.dmp
                        Download

                        memory/5352-128-0x0000000000400000-0x0000000000598000-memory.dmp
                        Download

                        memory/5580-19-0x0000000000400000-0x000000000058F000-memory.dmp
                        Download

                        memory/5580-1929-0x0000000000400000-0x000000000058F000-memory.dmp
                        Download

                        memory/5700-66-0x0000000000400000-0x0000000000598000-memory.dmp
                        Download

                        memory/6112-201-0x0000000000400000-0x0000000000598000-memory.dmp
                        Download