Overview

overview

10

Static

static

3

2026-08-17...ck.exe

windows10-2004-x64

10

2026-08-17...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/08/2026, 01:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe
  • Size 2.1MB
  • Sample260817-cejevsdl3x
  • SHA256 b8b143378153927f839ba88ab8010a9316bc2f583a8c9476792ebcb451774fd7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 21 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 21 IoCs
    defense_evasiontrojan
  • Renames multiple (115) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 21 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 42 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 63 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2812
    • C:\Users\Admin\REIgUMQw\IwMgUksc.exe
      "C:\Users\Admin\REIgUMQw\IwMgUksc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of FindShellTrayWindow
      PID:4776
    • C:\ProgramData\rGAEkYUA\jUsYUQAo.exe
      "C:\ProgramData\rGAEkYUA\jUsYUQAo.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:3804
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4364
      • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1000
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:244
          • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1944
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4076
              • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:5032
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3592
                  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:3928
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:4936
                      • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:4336
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:4236
                          • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock
                            13⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:2448
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock"
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:3176
                              • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock
                                15⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:4176
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:1760
                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock
                                    17⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:5108
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock"
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:3468
                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock
                                        19⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4468
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock"
                                          20⤵
                                          • Executes a command shell one-liner
                                          PID:4092
                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock
                                            21⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:1836
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock"
                                              22⤵
                                              • Executes a command shell one-liner
                                              PID:3816
                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe
                                                C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock
                                                23⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1952
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock"
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2420
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock
                                                    25⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:2640
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock"
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5676
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock
                                                        27⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:5516
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock"
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          PID:6100
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe
                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock
                                                            29⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:5140
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock"
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2304
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe
                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock
                                                                31⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:4900
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock"
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  PID:960
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock
                                                                    33⤵
                                                                      PID:1960
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock"
                                                                        34⤵
                                                                        • Executes a command shell one-liner
                                                                        PID:4360
                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock
                                                                          35⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:4348
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock"
                                                                            36⤵
                                                                            • Executes a command shell one-liner
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:1304
                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock
                                                                              37⤵
                                                                                PID:5532
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock"
                                                                                  38⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:1544
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock
                                                                                    39⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:4620
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock"
                                                                                      40⤵
                                                                                      • Executes a command shell one-liner
                                                                                      PID:2488
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock
                                                                                        41⤵
                                                                                          PID:4320
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock"
                                                                                            42⤵
                                                                                            • Executes a command shell one-liner
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:8
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                            42⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • Modifies registry key
                                                                                            PID:1612
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                            42⤵
                                                                                            • Modifies registry key
                                                                                            PID:3604
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                            42⤵
                                                                                            • UAC bypass
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Modifies registry key
                                                                                            PID:2908
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fWcksIsg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe""
                                                                                            42⤵
                                                                                            • Executes a command shell one-liner
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2512
                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                              43⤵
                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                              PID:2936
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                        40⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        • Modifies registry key
                                                                                        PID:3636
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                        40⤵
                                                                                        • Modifies registry key
                                                                                        PID:4152
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                        40⤵
                                                                                        • UAC bypass
                                                                                        • Modifies registry key
                                                                                        PID:4380
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DYQYAgsc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe""
                                                                                        40⤵
                                                                                        • Executes a command shell one-liner
                                                                                        PID:1384
                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                          41⤵
                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:2784
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                    38⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Modifies registry key
                                                                                    PID:1856
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                    38⤵
                                                                                    • Modifies registry key
                                                                                    PID:2544
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                    38⤵
                                                                                    • UAC bypass
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Modifies registry key
                                                                                    PID:5244
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\asYkYsAs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe""
                                                                                    38⤵
                                                                                    • Executes a command shell one-liner
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:6096
                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                      39⤵
                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                      PID:5684
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                36⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Modifies registry key
                                                                                PID:2168
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                36⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Modifies registry key
                                                                                PID:5200
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                36⤵
                                                                                • UAC bypass
                                                                                • Modifies registry key
                                                                                PID:5920
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QyggQsgE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe""
                                                                                36⤵
                                                                                • Executes a command shell one-liner
                                                                                PID:4992
                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                  37⤵
                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                  PID:1680
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                            34⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Modifies registry key
                                                                            PID:3092
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                            34⤵
                                                                            • Modifies registry key
                                                                            PID:2016
                                                                            • C:\Windows\System32\Conhost.exe
                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                              35⤵
                                                                                PID:3188
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                              34⤵
                                                                              • UAC bypass
                                                                              • Modifies registry key
                                                                              PID:2060
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VyYwQEMc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe""
                                                                              34⤵
                                                                              • Executes a command shell one-liner
                                                                              PID:1400
                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                35⤵
                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                PID:4500
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                          32⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Modifies registry key
                                                                          PID:2316
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                          32⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Modifies registry key
                                                                          PID:1160
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                          32⤵
                                                                          • UAC bypass
                                                                          • Modifies registry key
                                                                          PID:6076
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FkwgcoAc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe""
                                                                          32⤵
                                                                          • Executes a command shell one-liner
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2472
                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                            33⤵
                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:1596
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                      30⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies registry key
                                                                      PID:5352
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                      30⤵
                                                                      • Modifies registry key
                                                                      PID:5748
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                      30⤵
                                                                      • UAC bypass
                                                                      • Modifies registry key
                                                                      PID:3152
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pKkgYUgI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe""
                                                                      30⤵
                                                                      • Executes a command shell one-liner
                                                                      PID:2736
                                                                      • C:\Windows\System32\Conhost.exe
                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        31⤵
                                                                          PID:5480
                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                          31⤵
                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2776
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                    28⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • Modifies registry key
                                                                    PID:1176
                                                                    • C:\Windows\System32\Conhost.exe
                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      29⤵
                                                                        PID:5464
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                      28⤵
                                                                      • Modifies registry key
                                                                      PID:5568
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                      28⤵
                                                                      • UAC bypass
                                                                      • Modifies registry key
                                                                      PID:4740
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IagcYYUA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe""
                                                                      28⤵
                                                                      • Executes a command shell one-liner
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4768
                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                        29⤵
                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:4688
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                  26⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry key
                                                                  PID:4620
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                  26⤵
                                                                  • Modifies registry key
                                                                  PID:4804
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                  26⤵
                                                                  • UAC bypass
                                                                  • Modifies registry key
                                                                  PID:2128
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cIcAQckQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe""
                                                                  26⤵
                                                                  • Executes a command shell one-liner
                                                                  PID:5792
                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                    27⤵
                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                    PID:4380
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                              24⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry key
                                                              PID:1420
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                              24⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry key
                                                              PID:1980
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                              24⤵
                                                              • UAC bypass
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry key
                                                              PID:3100
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mwEUscMY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe""
                                                              24⤵
                                                              • Executes a command shell one-liner
                                                              PID:2584
                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                25⤵
                                                                • Executes a VBScript file via the Windows Script Host.
                                                                PID:5240
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                          22⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry key
                                                          PID:1076
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                          22⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry key
                                                          PID:2092
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                          22⤵
                                                          • UAC bypass
                                                          • Modifies registry key
                                                          PID:3536
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FkMwgcMU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe""
                                                          22⤵
                                                          • Executes a command shell one-liner
                                                          PID:2972
                                                          • C:\Windows\SysWOW64\cscript.exe
                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                            23⤵
                                                            • Executes a VBScript file via the Windows Script Host.
                                                            PID:5144
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                      20⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry key
                                                      PID:2476
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                      20⤵
                                                      • Modifies registry key
                                                      PID:1004
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                      20⤵
                                                      • UAC bypass
                                                      • Modifies registry key
                                                      PID:6068
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jQwQMAow.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe""
                                                      20⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      PID:3672
                                                      • C:\Windows\SysWOW64\cscript.exe
                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                        21⤵
                                                        • Executes a VBScript file via the Windows Script Host.
                                                        PID:2932
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                  18⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Modifies registry key
                                                  PID:1164
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                  18⤵
                                                  • Modifies registry key
                                                  PID:1804
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                  18⤵
                                                  • UAC bypass
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry key
                                                  PID:3708
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XMwIUIQM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe""
                                                  18⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4276
                                                  • C:\Windows\SysWOW64\cscript.exe
                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                    19⤵
                                                    • Executes a VBScript file via the Windows Script Host.
                                                    PID:2036
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                              16⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Modifies registry key
                                              PID:1764
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                              16⤵
                                              • Modifies registry key
                                              PID:124
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                              16⤵
                                              • UAC bypass
                                              • Modifies registry key
                                              PID:5464
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QOMcoQcs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe""
                                              16⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:5800
                                              • C:\Windows\SysWOW64\cscript.exe
                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                17⤵
                                                • Executes a VBScript file via the Windows Script Host.
                                                PID:4300
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                          14⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry key
                                          PID:5084
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                          14⤵
                                          • Modifies registry key
                                          PID:4772
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                          14⤵
                                          • UAC bypass
                                          • Modifies registry key
                                          PID:4492
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qqEoQMAQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe""
                                          14⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:3164
                                          • C:\Windows\SysWOW64\cscript.exe
                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                            15⤵
                                            • Executes a VBScript file via the Windows Script Host.
                                            PID:2832
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                      12⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry key
                                      PID:4084
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                      12⤵
                                      • Modifies registry key
                                      PID:3400
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                      12⤵
                                      • UAC bypass
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry key
                                      PID:4464
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JEQYsUEw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe""
                                      12⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:5796
                                      • C:\Windows\SysWOW64\cscript.exe
                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                        13⤵
                                        • Executes a VBScript file via the Windows Script Host.
                                        PID:3824
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                  10⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Modifies registry key
                                  PID:5024
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                  10⤵
                                  • Modifies registry key
                                  PID:6072
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                  10⤵
                                  • UAC bypass
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry key
                                  PID:2312
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tqckYgIg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe""
                                  10⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:1332
                                  • C:\Windows\SysWOW64\cscript.exe
                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                    11⤵
                                    • Executes a VBScript file via the Windows Script Host.
                                    PID:3100
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              • Modifies registry key
                              PID:1564
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                              8⤵
                              • Modifies registry key
                              PID:3188
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                              8⤵
                              • UAC bypass
                              • System Location Discovery: System Language Discovery
                              • Modifies registry key
                              PID:4404
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xAAUIooY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe""
                              8⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:5824
                              • C:\Windows\SysWOW64\cscript.exe
                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                9⤵
                                • Executes a VBScript file via the Windows Script Host.
                                PID:2248
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                          6⤵
                          • Modifies visibility of file extensions in Explorer
                          • Modifies registry key
                          PID:5148
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                          6⤵
                          • System Location Discovery: System Language Discovery
                          • Modifies registry key
                          PID:5480
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                          6⤵
                          • UAC bypass
                          • Modifies registry key
                          PID:4828
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wkYEskAU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe""
                          6⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:4632
                          • C:\Windows\SysWOW64\cscript.exe
                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                            7⤵
                            • Executes a VBScript file via the Windows Script Host.
                            PID:740
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                      4⤵
                      • Modifies visibility of file extensions in Explorer
                      • Modifies registry key
                      PID:3068
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                      4⤵
                      • System Location Discovery: System Language Discovery
                      • Modifies registry key
                      PID:5108
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                      4⤵
                      • UAC bypass
                      • System Location Discovery: System Language Discovery
                      • Modifies registry key
                      PID:5652
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iSgYwQgw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe""
                      4⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:2788
                      • C:\Windows\SysWOW64\cscript.exe
                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                        5⤵
                        • Executes a VBScript file via the Windows Script Host.
                        PID:480
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                  2⤵
                  • Modifies visibility of file extensions in Explorer
                  • System Location Discovery: System Language Discovery
                  • Modifies registry key
                  PID:2512
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                  2⤵
                  • Modifies registry key
                  PID:2544
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                  2⤵
                  • UAC bypass
                  • System Location Discovery: System Language Discovery
                  • Modifies registry key
                  PID:4824
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VgkcYIQM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock.exe""
                  2⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3276
                  • C:\Windows\SysWOW64\cscript.exe
                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                    3⤵
                    • Executes a VBScript file via the Windows Script Host.
                    PID:3624
              • C:\ProgramData\SGAMkcUM\kooYQMAE.exe
                C:\ProgramData\SGAMkcUM\kooYQMAE.exe
                1⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in System32 directory
                PID:5552
              • C:\Users\Admin\REIgUMQw\IwMgUksc.exe
                C:\Users\Admin\REIgUMQw\IwMgUksc.exe
                1⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                PID:2744
              • C:\ProgramData\rGAEkYUA\jUsYUQAo.exe
                C:\ProgramData\rGAEkYUA\jUsYUQAo.exe
                1⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                PID:4728
              • C:\Windows\System32\sihclient.exe
                C:\Windows\System32\sihclient.exe /cv 5/MLEjZiQU6dKBBGW48mAQ.0.2
                1⤵
                  PID:2476

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      2
                      T1059

                      Visual Basic

                      1
                      T1059.005

                      Windows Command Shell

                      1
                      T1059.003

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Privilege Escalation

                      Abuse Elevation Control Mechanism

                      1
                      T1548

                      Bypass User Account Control

                      1
                      T1548.002

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Defense Evasion

                      Abuse Elevation Control Mechanism

                      1
                      T1548

                      Bypass User Account Control

                      1
                      T1548.002

                      Hide Artifacts

                      1
                      T1564

                      Hidden Files and Directories

                      1
                      T1564.001

                      Impair Defenses

                      1
                      T1562

                      Disable or Modify Tools

                      1
                      T1562.001

                      Modify Registry

                      4
                      T1112

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Unsecured Credentials

                      1
                      T1552

                      Credentials In Files

                      1
                      T1552.001

                      Discovery

                      System Information Discovery

                      1
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      Lateral Movement

                      Collection

                      Data from Local System

                      1
                      T1005

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      kooYQMAE.exe
                      • Path C:\ProgramData\SGAMkcUM\kooYQMAE.exe
                      • Size 1.6MB
                      • SHA256 bb59a93de0cebe5315b2a8431431bc461596aebab3b8f675218847bf39eed052
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      oKMs.txt
                      • Path C:\ProgramData\oKMs.txt
                      • Size 8KB
                      • SHA256 c56d839221d79822462865490e9d186577c218389049400db8fee8de12256848
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      jUsYUQAo.exe
                      • Path C:\ProgramData\rGAEkYUA\jUsYUQAo.exe
                      • Size 1.6MB
                      • SHA256 63febbd186a04a5d0f3979437104b6b0b3b3aedf04ed5e61ae266b7fb964a0b9
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      jUsYUQAo.inf
                      • Path C:\ProgramData\rGAEkYUA\jUsYUQAo.inf
                      • Size 4B
                      • SHA256 c856bf7a2f347e830be325521e40fe12fcb0c42421a41a2580dfca8167ecd025
                      • MD5 SHA1 SHA512
                      Submit Download

                      jUsYUQAo.inf
                      • Path C:\ProgramData\rGAEkYUA\jUsYUQAo.inf
                      • Size 4B
                      • SHA256 7ad2df7b2eb971e425e0f3dedd89c0507b1910ff661d0f6a862cb79bfee2aa4a
                      • MD5 SHA1 SHA512
                      Submit Download

                      jUsYUQAo.inf
                      • Path C:\ProgramData\rGAEkYUA\jUsYUQAo.inf
                      • Size 4B
                      • SHA256 c3aff75366d4ae8cd2f3f71d1df9e0efd005cf05b1a3678431a36b519121c3db
                      • MD5 SHA1 SHA512
                      Submit Download

                      jUsYUQAo.inf
                      • Path C:\ProgramData\rGAEkYUA\jUsYUQAo.inf
                      • Size 4B
                      • SHA256 b8d67a8b77a7260cdd38f66a3346690f38ff41b8c2a2046dca185821338ca76d
                      • MD5 SHA1 SHA512
                      Submit Download

                      jUsYUQAo.inf
                      • Path C:\ProgramData\rGAEkYUA\jUsYUQAo.inf
                      • Size 4B
                      • SHA256 ea90361716dea9bbb281b19fda638512834a28c7da2ff4fb9700d39677b44f9c
                      • MD5 SHA1 SHA512
                      Submit Download

                      2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock
                      • Path C:\Users\Admin\AppData\Local\Temp\2026-08-17_9d90e65ca5ba6f0d5626fdecc6db8c36_elex_virlock
                      • Size 588KB
                      • SHA256 60ff5131dba68a8ffe7ba0475bf3e192b432e1969e5ac52d7f217f6935f4035d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      AAYU.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\AAYU.exe
                      • Size 3.0MB
                      • SHA256 4859e01e3b8271821c2e00a8dff46b0fdd1574848756fed5f264b8749b4faf97
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      AIQO.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\AIQO.exe
                      • Size 2.0MB
                      • SHA256 6d372c81b891aefcf85fdb4ea1962a6743082a3ad48c666d45de97e2e5724ce9
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      AIsK.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\AIsK.exe
                      • Size 1.7MB
                      • SHA256 ef89dcb6ad2fe04d8b2f38a34c896ec65237ddb6b0a443f34aa08a47ff84d509
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      AooU.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\AooU.exe
                      • Size 1.6MB
                      • SHA256 c3c69e064fbb5bab72036ec9718af7dbcd1396d78acfafa64ecc4d9af8d57e95
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      AswS.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\AswS.exe
                      • Size 1.6MB
                      • SHA256 7e7a1faf5b283f4da7b8894c2b59bf811718882c8b6fd9cfae5eea517685c629
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      CEgy.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\CEgy.exe
                      • Size 1.7MB
                      • SHA256 9a4b1c453362ba0177bf3b369fb8b1f83685c57d475b2dd06ddcde7431a3009c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Csoq.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\Csoq.exe
                      • Size 1.9MB
                      • SHA256 df1155ce0846dfeff9a7d73f3d6ca46ed3b0a376faaecc0ddc7c5667d36ca932
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      EAMg.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\EAMg.exe
                      • Size 2.2MB
                      • SHA256 2dc3a2994a7fcd4223fab2ccc2a526d071469071c7cbc40681667b04ddab61ee
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      EEsO.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\EEsO.exe
                      • Size 1.6MB
                      • SHA256 ffc98b86bca22c694b2f97475372b766d637c99e6084dcff5c769b00cbc0c9aa
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      EMwi.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\EMwi.exe
                      • Size 2.2MB
                      • SHA256 f179545e90391449b378d6768175b455d5e03a9a0bc148169096b7054155edfa
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      EUAY.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\EUAY.exe
                      • Size 1.6MB
                      • SHA256 38f5cd465283f8a94a156edbcf379f90455240d87722808a131283ce45ab84c1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      EYkQ.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\EYkQ.exe
                      • Size 1.6MB
                      • SHA256 bc2c53c3ec23ef66061e8e42f3e00324812429b34a7b0e47e4fca51711e546ad
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      EgAU.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\EgAU.exe
                      • Size 2.3MB
                      • SHA256 9877e852fa12d06e8715ea7f77b36ab3c8366a25dc305f3102b816bb17dfb479
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      GAAa.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\GAAa.exe
                      • Size 2.3MB
                      • SHA256 5dda7bf8d8b3c5a48389771763f31107bcb99a735aabf3d82157b00f3421b62f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      GMIU.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\GMIU.exe
                      • Size 2.1MB
                      • SHA256 6f62ca49909485a831dbad724cc87616438dc566805d7ccb0daabb0be1bc44ea
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      GUUo.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\GUUo.exe
                      • Size 1.6MB
                      • SHA256 d03f73ab281050aab585e8183f4e665412fbab690f983dc2f2e5a8b241d824ce
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      GYQo.ico
                      • Path C:\Users\Admin\AppData\Local\Temp\GYQo.ico
                      • Size 4KB
                      • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      GYsQ.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\GYsQ.exe
                      • Size 1.6MB
                      • SHA256 0ba8a8f21ce746adb5939cf1c1bd65ba6d9e60e2bbb2a222a5a30679fad122d3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Gckg.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\Gckg.exe
                      • Size 1.6MB
                      • SHA256 f2e81aad0a0ca4cae772d2491c140845009a11d6b03bed2192881336a1b5b110
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Ggsy.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\Ggsy.exe
                      • Size 2.0MB
                      • SHA256 97af7a5317cd61b670539919a4680247c3df5cb2b0719115463e84e9d441f716
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      GocM.ico
                      • Path C:\Users\Admin\AppData\Local\Temp\GocM.ico
                      • Size 4KB
                      • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IAsw.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\IAsw.exe
                      • Size 1.7MB
                      • SHA256 7f29791484e44c665e66ba5375cc160a24c53d3dc4111e73f44a931dce67e0c0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IMou.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\IMou.exe
                      • Size 1.6MB
                      • SHA256 0fa92e539a5a5212b47f2f03da24412f060db8f4bf57615633ebc9a3877892ac
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IwMI.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\IwMI.exe
                      • Size 1.6MB
                      • SHA256 8bce5e7b5104b0d9ce1d4c4aa1f1de1de4c541756f10735bd85b6cb34351669c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IwUK.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\IwUK.exe
                      • Size 1.6MB
                      • SHA256 6c1b017765d63f070728ad216d9caedcd5d513f7fb7f021d58a2d7ee0bf34824
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      KEYQ.ico
                      • Path C:\Users\Admin\AppData\Local\Temp\KEYQ.ico
                      • Size 4KB
                      • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Kgco.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\Kgco.exe
                      • Size 2.6MB
                      • SHA256 aa2f24d4dc0f74c2ca6fed526d40a032938083890a9cc40deccce26a511f4317
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Kooa.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\Kooa.exe
                      • Size 1.6MB
                      • SHA256 c365e244806a8ce3c82d7e2366e8fddf8ab0b86f64148218fea2f9f44aa28ce8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      KsYA.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\KsYA.exe
                      • Size 1.8MB
                      • SHA256 e5a32189c3938b246292d49b8b25a65185cd7c8999546894f2fb75b16a8261d1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      KwIu.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\KwIu.exe
                      • Size 1.6MB
                      • SHA256 7dc274a7d372d36804bccc68a0433f82b867c77e124110be46423d4a00efbbdd
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Kwwa.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\Kwwa.exe
                      • Size 2.5MB
                      • SHA256 e17c9310053bef2772de07771a3a936ee3dad22e061acce0dc7d1504445cb47a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MAgq.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\MAgq.exe
                      • Size 1.9MB
                      • SHA256 88eb0a4e5788f43147caefe1e3144882b3b01cf29d0e356fca3d2b3444e36541
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MEwW.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\MEwW.exe
                      • Size 1.9MB
                      • SHA256 3948997cefff7ae0a6dfd0a09a751cb1d1b70ed81b0c19332763a9b72e9785b2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MMIS.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\MMIS.exe
                      • Size 1.6MB
                      • SHA256 4464134c72a4a492cdc5d31705bcff7a4e8690dd14a5f4d200e839b6947cf492
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      McUE.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\McUE.exe
                      • Size 1.6MB
                      • SHA256 1cb3b4f32796d089d854d9aed20789414819802e9f03e2546375c708e643faa8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MgUk.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\MgUk.exe
                      • Size 2.0MB
                      • SHA256 df6aeeabe94985f606b84bbfa51eb8891e478fd03727951addba16740db1ab97
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MsAC.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\MsAC.exe
                      • Size 2.6MB
                      • SHA256 6b831bf67e748ca7c8b47e4db8880301118bc34b75ff64a135d241dedd4156b3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MsUs.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\MsUs.exe
                      • Size 1.9MB
                      • SHA256 cdf5fa10a618814707622a8cf2607a993becdb91650dc9d722f4ff1e55e83e06
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MwAQ.ico
                      • Path C:\Users\Admin\AppData\Local\Temp\MwAQ.ico
                      • Size 4KB
                      • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OEQC.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\OEQC.exe
                      • Size 2.1MB
                      • SHA256 ae8f280d6b071c5c415bd7a3202dfdd61996a566749e1621c477cc68148842e1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OEsi.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\OEsi.exe
                      • Size 2.0MB
                      • SHA256 349395ff8d1b2841f8097d9873b140dd07d2101374c31fe0bfa97413a0e49152
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OIou.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\OIou.exe
                      • Size 1.6MB
                      • SHA256 58c0e94e554029db77781dd431aba8800af339f51eb2ec34b9a0133bb97fd618
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OMci.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\OMci.exe
                      • Size 2.0MB
                      • SHA256 433d8f78408684921bc52b0bd92c4ead9f750463d17f5099c59cc78c96f02481
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OYMY.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\OYMY.exe
                      • Size 1.9MB
                      • SHA256 c08e79bcaf3718dfe6b89d57dd20e93f68dd71cfc987f906b780fa391b4eb330
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OYss.ico
                      • Path C:\Users\Admin\AppData\Local\Temp\OYss.ico
                      • Size 4KB
                      • SHA256 e1131246c60ad423586203bb8b9287e365051101ddbf532132bd47ef03ab86c8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Oswy.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\Oswy.exe
                      • Size 2.1MB
                      • SHA256 b1ba614b9a2640aae9453e6eee7cb39fbb669e4fc8788f5c025338e66075695d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      QAkU.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\QAkU.exe
                      • Size 2.4MB
                      • SHA256 8df06a239110c17773f6bec8a0de7e9adf7484dc4e40a44e7c163453f64ee84a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      QAsq.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\QAsq.exe
                      • Size 1.8MB
                      • SHA256 2fe9729810f98bcbdc11919c26c86fdc4a83ac1d55caa4afd6e5c13af3fb8624
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      QMgw.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\QMgw.exe
                      • Size 1.9MB
                      • SHA256 b317a3961b8c1bec7332d68371cf48e5612f4f444eff36e028c9c873b19c4d4c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      QMsS.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\QMsS.exe
                      • Size 1.6MB
                      • SHA256 f0f2c1229e133501c19599d1c5fc1b16683428df1d59ca2f05bf6024e66b2526
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      QQca.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\QQca.exe
                      • Size 2.0MB
                      • SHA256 1394198132791d37e70a6edb96b02e755a7e930467c09a6e9c82ba727a4a67d0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      QYMI.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\QYMI.exe
                      • Size 1.9MB
                      • SHA256 4dea838f88c1abe4ac22d1475c3a9de6d3e24931e27c2edf5acf76a3f13b9d2d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      QgwU.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\QgwU.exe
                      • Size 1.8MB
                      • SHA256 77f0bfc9b9b371899790500d37b4f7a3709abc796c5fffbfff85e2ec35ba597a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      QkQY.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\QkQY.exe
                      • Size 1.9MB
                      • SHA256 b0220592ab0c5d58a64a97d66c8772bb2c189d0f2950a023763c97430e827ba8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      UAgS.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\UAgS.exe
                      • Size 2.0MB
                      • SHA256 2f3f03beae30fc63cf9f5139340c9d98cb51f7424edc16ec7f4857b14d89577b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      UIQE.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\UIQE.exe
                      • Size 1.7MB
                      • SHA256 0076d3f1aedee34ca77e2f7497c3246b15a802ba39bbe3e70b133567d50df264
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      UccK.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\UccK.exe
                      • Size 1.6MB
                      • SHA256 7f9df30201f99956dea374bd8d81dffccc28a0ece6fa1b42c9913a6da00eb1f1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      UowI.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\UowI.exe
                      • Size 2.2MB
                      • SHA256 141cfd9bfce1b0d617eeae993e0d4d361e54db8190d92abe56e4e3eab87fa5c7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      UwMM.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\UwMM.exe
                      • Size 1.9MB
                      • SHA256 5a5e26bd72ffcff4d824b60347c63ad9e553d90281e0f1013904cc0674bac592
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      VgkcYIQM.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\VgkcYIQM.bat
                      • Size 112B
                      • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      WEky.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\WEky.exe
                      • Size 1.8MB
                      • SHA256 04f8ecf61e19c587f5a7872a9c4d4238e7e06205e4de38029f9564d861820276
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WIUg.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\WIUg.exe
                      • Size 1.6MB
                      • SHA256 4484a1f085405792da5faf3df4457444680c2c85c80f86eaf4f93e8467c75f1d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WcwS.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\WcwS.exe
                      • Size 1.6MB
                      • SHA256 15d95981546c857e998e2e938ee5d3308def4b5a427c1f7e46415e2b10738b5d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WsQG.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\WsQG.exe
                      • Size 2.0MB
                      • SHA256 b5ecd1c93651d99b0ec0003e84a7bb9009273bf19279b52afc276e2882a67580
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WsoK.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\WsoK.exe
                      • Size 2.2MB
                      • SHA256 57e7f48d01b4dbedc00391c3c00b62faf187aa6bfd3759058c5fdc7020ad8002
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      YOwk.ico
                      • Path C:\Users\Admin\AppData\Local\Temp\YOwk.ico
                      • Size 4KB
                      • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      YQUo.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\YQUo.exe
                      • Size 1.9MB
                      • SHA256 b872034feace0d774c9bdcedd7c8c756ff9407235352cf091bd9463be74c66a9
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      YgAG.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\YgAG.exe
                      • Size 1.9MB
                      • SHA256 12f6cad586aa1e92517474cb09aab94e06684be9858509cff9a6b6f6c4ed09a8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Ykwi.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\Ykwi.exe
                      • Size 2.1MB
                      • SHA256 50cf732012edabd53bff3cfabca9ab8ccefd301c94a4f86ad3a6df48724bb4ba
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      YoAk.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\YoAk.exe
                      • Size 2.4MB
                      • SHA256 1a877e07ccff8486f2001faac137fe3e9e508c4e5081cebcc4ba366e843cc051
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      YqUs.ico
                      • Path C:\Users\Admin\AppData\Local\Temp\YqUs.ico
                      • Size 4KB
                      • SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      aAgQ.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\aAgQ.exe
                      • Size 1.6MB
                      • SHA256 346c21f17dd554eabb34c206f75abba5529dc656abb05c4eb795c5985f1bf257
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      aEAO.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\aEAO.exe
                      • Size 2.1MB
                      • SHA256 761dd3988e92cae185daa5305e66c1d56259a8f91e2d45fed2e420dc1afbce55
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      aIIK.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\aIIK.exe
                      • Size 2.0MB
                      • SHA256 30ad04e734f91a7f4ef6eeb877d4a7c65358c681c865ddef425c57b7d6a245c6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      aKss.ico
                      • Path C:\Users\Admin\AppData\Local\Temp\aKss.ico
                      • Size 4KB
                      • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      aQwQ.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\aQwQ.exe
                      • Size 1.7MB
                      • SHA256 215c870d0d0648f3c2a79f038281cc7dedd21afd7cb173a3d361222650d5ba9f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      agUk.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\agUk.exe
                      • Size 1.8MB
                      • SHA256 982f72dfdbe9534eb3982aa7b46129201e5298b6cfcddb1979ce3fc8a4fdd60c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      cAco.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\cAco.exe
                      • Size 2.1MB
                      • SHA256 6eefb4c78e137a509e600eca47936af82ecfbbdced452553ca273b827fb4c3e2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ckEe.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\ckEe.exe
                      • Size 2.1MB
                      • SHA256 64676fbc6fc24c71b2283f2115f185d9187c6f87bc645546b1a0cb8d6d54ad1f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ckoC.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\ckoC.exe
                      • Size 2.2MB
                      • SHA256 c09237d3bff3f7e4a4862be4183dc6d720a4eba7c8fc31a6388e6f5bcfe5bf33
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      eEcK.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\eEcK.exe
                      • Size 2.2MB
                      • SHA256 08fbc27bcfdc03895b7440801e22fffd265a6e53bc9dfa4b238027f9bb56126d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      eIUm.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\eIUm.exe
                      • Size 2.8MB
                      • SHA256 00aca9663582561fae686a4f836847496f0f3ed2d3963367768023264b3f0bec
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ecsK.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\ecsK.exe
                      • Size 2.1MB
                      • SHA256 ded5bc6c34bddbf27ab275aacf5e098da6168410fbe3e0b137598b444c20a821
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ekQW.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\ekQW.exe
                      • Size 2.0MB
                      • SHA256 57c611c702c4d556f828f5743ee4ee11877dfb9eedf950ca09bcf7b1d091ac38
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      eoYs.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\eoYs.exe
                      • Size 2.2MB
                      • SHA256 8029046ec2c623b2721aa252d54824e487939e9bc9c295fac982e228c34eb002
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      esAE.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\esAE.exe
                      • Size 1.7MB
                      • SHA256 ea2d9dc6f2bf61947650407b93cb5428ded29afc73ac3ccb4580664213309450
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      file.vbs
                      • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                      • Size 19B
                      • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                      • MD5 SHA1 SHA512
                      Submit Download

                      gMwE.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\gMwE.exe
                      • Size 3.3MB
                      • SHA256 f31e057efb44e47944dd66616d9313963985d66e35885d76408523f3252dc4c2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      gUMK.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\gUMK.exe
                      • Size 1.9MB
                      • SHA256 27fd17c1e514768e1095662e6d610eed1125b11ff8cb565fd67e116fd339e676
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      gUUA.ico
                      • Path C:\Users\Admin\AppData\Local\Temp\gUUA.ico
                      • Size 4KB
                      • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      gUYa.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\gUYa.exe
                      • Size 2.0MB
                      • SHA256 3a403531d1378ef6a516652409acfc885bf0546b4f256c14afefb87a8ee52727
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      gcQK.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\gcQK.exe
                      • Size 2.1MB
                      • SHA256 23d7b350fe997a90e255c117f1fe0777353e634333e72a5355fd2fabb1565333
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ggAq.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\ggAq.exe
                      • Size 1.8MB
                      • SHA256 c1a207db60df1ba2aa8798a0748dfd8b49fe57e91aeb6f55e8e0186ae5d94218
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      gggW.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\gggW.exe
                      • Size 2.0MB
                      • SHA256 1b3f612c30fee0948eac7808b01043dbd38b583a1b2b9d7806971b4db0f32521
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      gwoW.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\gwoW.exe
                      • Size 2.1MB
                      • SHA256 747de62d1f4e44a796fd5a596c6b37f32c92265cac3ad28cc97b5c6cf9345786
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      iEsc.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\iEsc.exe
                      • Size 1.6MB
                      • SHA256 28a9e9183262ebd5eb4a4678d996c1bb7bfb314b471c0b75ce1f23319ad70f2c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      iMwC.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\iMwC.exe
                      • Size 1.6MB
                      • SHA256 f93f8dbf2c3b31fc155ca191e7f1becf6936ef0e48a391c3054b2ec356ed61d8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      iQki.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\iQki.exe
                      • Size 2.1MB
                      • SHA256 01811abef96a5baa37698eb7ea9c97942d42f89ee357ed64f952cf68b1ab257d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      icQw.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\icQw.exe
                      • Size 2.4MB
                      • SHA256 63ef07794f62e06e0806f6ed5ddb318f7548b95a03310bfd458768f469dbd81d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      igEC.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\igEC.exe
                      • Size 1.6MB
                      • SHA256 a014d7572cf4b2b76a1c7c52c4b58c359b4735a315cac26ec8f4b39cfaf60224
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ikkC.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\ikkC.exe
                      • Size 1.8MB
                      • SHA256 71a8f5b0ccdec03c3aed268101041e1315320065389f6f0efb952cef9e094a65
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      issM.ico
                      • Path C:\Users\Admin\AppData\Local\Temp\issM.ico
                      • Size 4KB
                      • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      kIkE.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\kIkE.exe
                      • Size 2.0MB
                      • SHA256 67b21e6483d1a0280764aec9ae49118a6b4fdcb4cf5c7ee7b6bc7aa62d5e7cf8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      kMwk.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\kMwk.exe
                      • Size 1.7MB
                      • SHA256 1ed799fa40b63e1706a3e099c40b2f8e901a6faf5a7e7dd7a916ca42c92ac8f0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      kQEm.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\kQEm.exe
                      • Size 1.6MB
                      • SHA256 1fd4d6f8bfa2f8f9ff9492dd6a7f1857ce18f40865f581b6d34b2337ce302d72
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      kQQs.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\kQQs.exe
                      • Size 2.4MB
                      • SHA256 3cd4a4400082b559e95fc3a397dd52958a606071cda8bfb2060bd045b3a5c867
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      kUEI.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\kUEI.exe
                      • Size 1.9MB
                      • SHA256 f7ae789128f74119c7900fee905bf30de351aee61d6cc4cc69d060a66c818d8e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      kYku.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\kYku.exe
                      • Size 3.1MB
                      • SHA256 ea9077dbe7d87d37f54cbb7929b5c5dbb98dd33b837f1575c589662b58e2a4ac
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      kwEu.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\kwEu.exe
                      • Size 1.7MB
                      • SHA256 0dbb7a1ff7cdf0ec918c37dce4c3ed98a5a8f82113eadbc7fc9c47dcd544283a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      kwQi.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\kwQi.exe
                      • Size 2.0MB
                      • SHA256 8a9d7b695d1e1b600a60672b1dfbe6f1aef0f0d315a90ae8055b8bc72e76d334
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      mIAq.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\mIAq.exe
                      • Size 1.6MB
                      • SHA256 d5e828e6286139d6edf45a342480842ff0b12f04aba6cf15c33e087b29b42681
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      mUkG.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\mUkG.exe
                      • Size 2.1MB
                      • SHA256 d27975f0fa5b0491278fc23c379e5e0db0f15caf16575281d25a272c007222a5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      mUsG.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\mUsG.exe
                      • Size 2.1MB
                      • SHA256 a7598860918fa83de21d3a39709bd1aeca22f2aeebf41502b7f3de20d81cc60d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      mcUg.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\mcUg.exe
                      • Size 1.9MB
                      • SHA256 77f2c017b67263d49251f6b73c46723cbd94c9e2ac4e878c6348db4f70a3da9f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      mgso.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\mgso.exe
                      • Size 1.9MB
                      • SHA256 31173f4c78b5a65f709800d0a5d141c098af01e8a647210389bf8bd62556e87c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      mkwq.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\mkwq.exe
                      • Size 1.6MB
                      • SHA256 bbb1794680a25d18544ff703dc0aebc8436a0dd9647f7b17a4217b0e49ea0622
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      mswG.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\mswG.exe
                      • Size 1.6MB
                      • SHA256 2e5454ac3a2147efdee73023ea291d451f971e606973dc178bed4ceb82b57a38
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      oAsI.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\oAsI.exe
                      • Size 1.8MB
                      • SHA256 34259227c064bcdcd8c0baf4f4e13b42a588d91ee157610b13750e1b08ee1450
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      oOcE.ico
                      • Path C:\Users\Admin\AppData\Local\Temp\oOcE.ico
                      • Size 4KB
                      • SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      oQYU.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\oQYU.exe
                      • Size 1.6MB
                      • SHA256 bce23196903fe1c702a047f2325b5c060c8ff4ed7b07ec7608a16fd911c20e1f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ooYQ.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\ooYQ.exe
                      • Size 1.6MB
                      • SHA256 8d0b33080bd22c6ee18ba6ed3eacb58d1e4e6ccc8c558efb6b1a195a10bf5c06
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      oogc.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\oogc.exe
                      • Size 1.9MB
                      • SHA256 7e22a44ae4f7e68bfc85bf41ef37b62c72aa7530c9f9b38bdc4bd091704863a4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      owYC.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\owYC.exe
                      • Size 2.0MB
                      • SHA256 8c0ac415f6dadde44a24c0fb71d062eeef3c95511b1a04dec1eecda806541083
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      qUYy.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\qUYy.exe
                      • Size 2.7MB
                      • SHA256 19f79d9954a33721772895b684ea1c10e35aaa1be4f621e444227f55016f96c4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      qkkY.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\qkkY.exe
                      • Size 2.1MB
                      • SHA256 fbaa8c8dcc62e872268db320faf371f43db808e961fd486641b9f7590a610d89
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      sAUs.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\sAUs.exe
                      • Size 2.0MB
                      • SHA256 54531272410f3b2f65ce3f6ed218c8d049a7b80cc72c41f01a6fa183f91a924f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      sIQM.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\sIQM.exe
                      • Size 1.7MB
                      • SHA256 75e696edde6371d17da99257a67799e55a148ab331232f9cc7c4473d00dc9a74
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      sYwO.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\sYwO.exe
                      • Size 1.6MB
                      • SHA256 bd069f96d674b1708e6b6147e70d9554060b5de71261cc0b0c29d128f64474f7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      skcy.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\skcy.exe
                      • Size 1.8MB
                      • SHA256 ba9a82c7dd4165d26e99fa338877aa2a3c40139a5a14c335830af56ba45847e2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ssYg.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\ssYg.exe
                      • Size 1.6MB
                      • SHA256 b4ce400ae78b41672b183b86a8b2624c2fb3a1af2c04cb89e58490eddc902cb4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ssog.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\ssog.exe
                      • Size 2.0MB
                      • SHA256 16b85edc092c8dead90f2d66a3c6c8799d7610bc8acca7668aca271ca0efead8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      uAMU.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\uAMU.exe
                      • Size 2.9MB
                      • SHA256 8ea18cccc7da640ab4b99439add4946eea111c244c5e033eaa85e1e08733c09d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      uEYW.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\uEYW.exe
                      • Size 1.9MB
                      • SHA256 5ab36238b405577886775c5e758d55e864dc17013aed69d475e14fcfdf3e28bf
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      uccS.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\uccS.exe
                      • Size 1.6MB
                      • SHA256 1dc06dff26c46fdc0f38548659835d80193fc0029b60713b4b8a442826ae664e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      usAC.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\usAC.exe
                      • Size 1.8MB
                      • SHA256 4f232cbaf9cc8b0d9e9872edfb0702ed1fb9d5ca0293dd5790e05e36c8426d00
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      uwgM.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\uwgM.exe
                      • Size 2.0MB
                      • SHA256 01a2e63f69bdd852ce96806db32951134a89369fff06eee227e8828b529c4251
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      uwog.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\uwog.exe
                      • Size 1.6MB
                      • SHA256 014eb9074429e8185fe6356a065e2879ab318e857b73cc29f224e96a59312ef0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wgcE.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\wgcE.exe
                      • Size 3.1MB
                      • SHA256 0a140dcf47d129be78c7eaddaf5caac53fa38830ffe5cd7e9662a06826ae7cfc
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      woIK.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\woIK.exe
                      • Size 1.6MB
                      • SHA256 a7582699f80d3c31ac2c66c503eba42cc3abfc6ab554ad51d133af2027169940
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wssE.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\wssE.exe
                      • Size 2.5MB
                      • SHA256 0521ea606f2e3862c607b29bb8e339b6bf3676c2907c717ed89b6e281eb19795
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wwUc.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\wwUc.exe
                      • Size 2.8MB
                      • SHA256 36c0ca353d7a6fe60880b2208fbcff7d43c0ab5bd0d2f868d1cbf3b06abcf001
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wwks.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\wwks.exe
                      • Size 1.7MB
                      • SHA256 c2dfc5fbfef478965dfb04d52ad8afbb48f9b0124013c23251a6eb3c7fb318d0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      yIYi.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\yIYi.exe
                      • Size 3.5MB
                      • SHA256 9918155f67af6655c27f8857a3a2ede94a87f3b63ace02afa9317eaf713cee90
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      yYse.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\yYse.exe
                      • Size 2.5MB
                      • SHA256 05e68d46b4ecfaa4410049c6981b9ca5e23deed647bfcc779ccc1765bce30ebb
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ycgu.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\ycgu.exe
                      • Size 1.6MB
                      • SHA256 43f6e3170142c32260e55c7aab73ebf12f019bc6883346492a65d7e71d135cc0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ycwe.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\ycwe.exe
                      • Size 2.8MB
                      • SHA256 e50d69d49598adf711020e15292e9af8ad77cd34749fba1d41cc8eb404fb5fe0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ysgy.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\ysgy.exe
                      • Size 1.6MB
                      • SHA256 972650d07e063a59b3053a3e888e28f8cf268b305dab9469e345cc7075e62a96
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IwMgUksc.exe
                      • Path C:\Users\Admin\REIgUMQw\IwMgUksc.exe
                      • Size 1.6MB
                      • SHA256 0caff49939ad013343ca2d721d0bac3cfdf3e2a84b8b8759f0a40897a63ad584
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IwMgUksc.inf
                      • Path C:\Users\Admin\REIgUMQw\IwMgUksc.inf
                      • Size 4B
                      • SHA256 04c27fe07394747e05589ad6dc98cb5506313e652e36a04c2b42de5e5570c757
                      • MD5 SHA1 SHA512
                      Submit Download

                      memory/1000-47-0x0000000000400000-0x0000000000624000-memory.dmp
                      Download

                      memory/1836-188-0x0000000000400000-0x0000000000624000-memory.dmp
                      Download

                      memory/1944-68-0x0000000000400000-0x0000000000624000-memory.dmp
                      Download

                      memory/1952-200-0x0000000000400000-0x0000000000624000-memory.dmp
                      Download

                      memory/1960-259-0x0000000000400000-0x0000000000624000-memory.dmp
                      Download

                      memory/1960-244-0x0000000000400000-0x0000000000624000-memory.dmp
                      Download

                      memory/2448-125-0x0000000000400000-0x0000000000624000-memory.dmp
                      Download

                      memory/2640-215-0x0000000000400000-0x0000000000624000-memory.dmp
                      Download

                      memory/2744-2068-0x0000000000400000-0x000000000058F000-memory.dmp
                      Download

                      memory/2812-33-0x00000000023C0000-0x00000000023E0000-memory.dmp
                      Download

                      memory/2812-32-0x0000000000400000-0x0000000000624000-memory.dmp
                      Download

                      memory/2812-0-0x0000000000400000-0x0000000000624000-memory.dmp
                      Download

                      memory/2812-1-0x00000000023C0000-0x00000000023E0000-memory.dmp
                      Download

                      memory/3804-16-0x0000000000400000-0x000000000058F000-memory.dmp
                      Download

                      memory/3804-2054-0x0000000000400000-0x000000000058F000-memory.dmp
                      Download

                      memory/3928-98-0x0000000000400000-0x0000000000624000-memory.dmp
                      Download

                      memory/4176-142-0x0000000000400000-0x0000000000624000-memory.dmp
                      Download

                      memory/4320-303-0x0000000000400000-0x0000000000624000-memory.dmp
                      Download

                      memory/4336-112-0x0000000000400000-0x0000000000624000-memory.dmp
                      Download

                      memory/4348-270-0x0000000000400000-0x0000000000624000-memory.dmp
                      Download

                      memory/4468-172-0x0000000000400000-0x0000000000624000-memory.dmp
                      Download

                      memory/4620-292-0x0000000000400000-0x0000000000624000-memory.dmp
                      Download

                      memory/4728-2077-0x0000000000400000-0x000000000058F000-memory.dmp
                      Download

                      memory/4776-2049-0x0000000000400000-0x000000000058F000-memory.dmp
                      Download

                      memory/4776-1880-0x00000000042E0000-0x0000000004300000-memory.dmp
                      Download

                      memory/4776-310-0x00000000042E0000-0x0000000004300000-memory.dmp
                      Download

                      memory/4776-8-0x0000000000400000-0x000000000058F000-memory.dmp
                      Download

                      memory/4900-249-0x0000000000400000-0x0000000000624000-memory.dmp
                      Download

                      memory/5032-80-0x0000000000400000-0x0000000000624000-memory.dmp
                      Download

                      memory/5108-156-0x0000000000400000-0x0000000000624000-memory.dmp
                      Download

                      memory/5140-237-0x0000000000400000-0x0000000000624000-memory.dmp
                      Download

                      memory/5516-228-0x0000000000400000-0x0000000000624000-memory.dmp
                      Download

                      memory/5532-282-0x0000000000400000-0x0000000000624000-memory.dmp
                      Download

                      memory/5552-19-0x0000000000400000-0x000000000058F000-memory.dmp
                      Download

                      memory/5552-2059-0x0000000000400000-0x000000000058F000-memory.dmp
                      Download