Overview

overview

10

Static

static

3

2026-08-20...ck.exe

windows10-2004-x64

10

2026-08-20...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 03:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe
  • Size 1.6MB
  • Sample260820-dqcbcsbb69
  • SHA256 68a9f68a682c04f62430267887c72059590672cfdead7ad575ac7c5f9eeba03a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 19 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 19 IoCs
    defense_evasiontrojan
  • Renames multiple (91) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 19 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 38 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 57 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4324
    • C:\Users\Admin\CgMQcUoA\BQgEoUoc.exe
      "C:\Users\Admin\CgMQcUoA\BQgEoUoc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      PID:5152
    • C:\ProgramData\KwIAUsEM\FYEAkgww.exe
      "C:\ProgramData\KwIAUsEM\FYEAkgww.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:5024
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4224
      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2616
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1736
          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2936
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4236
              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3880
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4368
                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4728
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:2204
                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock
                        11⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:4652
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:784
                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock
                            13⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:4208
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock"
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:3548
                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:2856
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:3844
                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:4364
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock"
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:5940
                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock
                                        19⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1140
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock"
                                          20⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          PID:4760
                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock
                                            21⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:1464
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock"
                                              22⤵
                                              • Executes a command shell one-liner
                                              PID:4920
                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe
                                                C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock
                                                23⤵
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:2980
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock"
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2000
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock
                                                    25⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:5772
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock"
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      PID:4248
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock
                                                        27⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:4148
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock"
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          PID:1732
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe
                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock
                                                            29⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:4472
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock"
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              PID:3508
                                                              • C:\Windows\System32\Conhost.exe
                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                31⤵
                                                                  PID:1216
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock
                                                                  31⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:4648
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock"
                                                                    32⤵
                                                                    • Executes a command shell one-liner
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:5476
                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock
                                                                      33⤵
                                                                        PID:1432
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock"
                                                                          34⤵
                                                                          • Executes a command shell one-liner
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:5672
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock
                                                                            35⤵
                                                                              PID:4192
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock"
                                                                                36⤵
                                                                                • Executes a command shell one-liner
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5856
                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock
                                                                                  37⤵
                                                                                    PID:1816
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock"
                                                                                      38⤵
                                                                                      • Executes a command shell one-liner
                                                                                      PID:4628
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                      38⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      • Modifies registry key
                                                                                      PID:1260
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                      38⤵
                                                                                      • Modifies registry key
                                                                                      PID:1300
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                      38⤵
                                                                                      • UAC bypass
                                                                                      • Modifies registry key
                                                                                      PID:4180
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\csswUcwM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe""
                                                                                      38⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:3296
                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                        39⤵
                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:1084
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                  36⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • Modifies registry key
                                                                                  PID:6096
                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                    37⤵
                                                                                      PID:572
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                    36⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Modifies registry key
                                                                                    PID:2452
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                    36⤵
                                                                                    • UAC bypass
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Modifies registry key
                                                                                    PID:2636
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FgoYMwAE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe""
                                                                                    36⤵
                                                                                    • Executes a command shell one-liner
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:4080
                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                      37⤵
                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:5496
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                34⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Modifies registry key
                                                                                PID:1620
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                34⤵
                                                                                • Modifies registry key
                                                                                PID:5096
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                34⤵
                                                                                • UAC bypass
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Modifies registry key
                                                                                PID:3036
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\joQogUck.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe""
                                                                                34⤵
                                                                                • Executes a command shell one-liner
                                                                                PID:4512
                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                  35⤵
                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:2184
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                            32⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Modifies registry key
                                                                            PID:4212
                                                                            • C:\Windows\System32\Conhost.exe
                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                              33⤵
                                                                                PID:932
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                              32⤵
                                                                              • Modifies registry key
                                                                              PID:3064
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                              32⤵
                                                                              • UAC bypass
                                                                              • Modifies registry key
                                                                              PID:4376
                                                                              • C:\Windows\System32\Conhost.exe
                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                33⤵
                                                                                  PID:6016
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LQYEkIoc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe""
                                                                                32⤵
                                                                                • Executes a command shell one-liner
                                                                                PID:4332
                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                  33⤵
                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                  PID:3888
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                            30⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Modifies registry key
                                                                            PID:2664
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                            30⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Modifies registry key
                                                                            PID:4088
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                            30⤵
                                                                            • UAC bypass
                                                                            • Modifies registry key
                                                                            PID:4856
                                                                            • C:\Windows\System32\Conhost.exe
                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                              31⤵
                                                                                PID:5228
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iiYsckwE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe""
                                                                              30⤵
                                                                              • Executes a command shell one-liner
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2248
                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                31⤵
                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5612
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                          28⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Modifies registry key
                                                                          PID:5712
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                          28⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Modifies registry key
                                                                          PID:4812
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                          28⤵
                                                                          • UAC bypass
                                                                          • Modifies registry key
                                                                          PID:256
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cmEcMEIA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe""
                                                                          28⤵
                                                                          • Executes a command shell one-liner
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:1136
                                                                          • C:\Windows\System32\Conhost.exe
                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                            29⤵
                                                                              PID:2400
                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                              29⤵
                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                              PID:944
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                        26⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Modifies registry key
                                                                        PID:1552
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                        26⤵
                                                                        • Modifies registry key
                                                                        PID:2544
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                        26⤵
                                                                        • UAC bypass
                                                                        • Modifies registry key
                                                                        PID:5076
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\umYAoIoM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe""
                                                                        26⤵
                                                                        • Executes a command shell one-liner
                                                                        PID:972
                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                          27⤵
                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                          PID:3952
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                    24⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies registry key
                                                                    PID:572
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                    24⤵
                                                                    • Modifies registry key
                                                                    PID:5648
                                                                    • C:\Windows\System32\Conhost.exe
                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      25⤵
                                                                        PID:5732
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                      24⤵
                                                                      • UAC bypass
                                                                      • Modifies registry key
                                                                      PID:5296
                                                                      • C:\Windows\System32\Conhost.exe
                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        25⤵
                                                                          PID:1280
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\piAcoQAg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe""
                                                                        24⤵
                                                                        • Executes a command shell one-liner
                                                                        PID:3352
                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                          25⤵
                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                          PID:4936
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                    22⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • Modifies registry key
                                                                    PID:4664
                                                                    • C:\Windows\System32\Conhost.exe
                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      23⤵
                                                                        PID:2672
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                      22⤵
                                                                      • Modifies registry key
                                                                      PID:4736
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                      22⤵
                                                                      • UAC bypass
                                                                      • Modifies registry key
                                                                      PID:3136
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vGsoEsoU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe""
                                                                      22⤵
                                                                      • Executes a command shell one-liner
                                                                      PID:5656
                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                        23⤵
                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:5980
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                  20⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry key
                                                                  PID:6016
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                  20⤵
                                                                  • Modifies registry key
                                                                  PID:5604
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                  20⤵
                                                                  • UAC bypass
                                                                  • Modifies registry key
                                                                  PID:4916
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PUgwoAkk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe""
                                                                  20⤵
                                                                  • Executes a command shell one-liner
                                                                  PID:5440
                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                    21⤵
                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4256
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                              18⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry key
                                                              PID:5936
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                              18⤵
                                                              • Modifies registry key
                                                              PID:5228
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                              18⤵
                                                              • UAC bypass
                                                              • Modifies registry key
                                                              PID:2344
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QckAAoYE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe""
                                                              18⤵
                                                              • Executes a command shell one-liner
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4412
                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                19⤵
                                                                • Executes a VBScript file via the Windows Script Host.
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1068
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                          16⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry key
                                                          PID:716
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                          16⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry key
                                                          PID:1992
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                          16⤵
                                                          • UAC bypass
                                                          • Modifies registry key
                                                          PID:5624
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oSsoIYsM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe""
                                                          16⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3748
                                                          • C:\Windows\SysWOW64\cscript.exe
                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                            17⤵
                                                            • Executes a VBScript file via the Windows Script Host.
                                                            PID:5556
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                      14⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Modifies registry key
                                                      PID:4416
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                      14⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry key
                                                      PID:4948
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                      14⤵
                                                      • UAC bypass
                                                      • Modifies registry key
                                                      PID:4668
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sccAAswY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe""
                                                      14⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5468
                                                      • C:\Windows\SysWOW64\cscript.exe
                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                        15⤵
                                                        • Executes a VBScript file via the Windows Script Host.
                                                        PID:6132
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                  12⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Modifies registry key
                                                  PID:5732
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                  12⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry key
                                                  PID:1280
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                  12⤵
                                                  • UAC bypass
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry key
                                                  PID:5192
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VwsEAAYE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe""
                                                  12⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3764
                                                  • C:\Windows\SysWOW64\cscript.exe
                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                    13⤵
                                                    • Executes a VBScript file via the Windows Script Host.
                                                    • System Location Discovery: System Language Discovery
                                                    PID:1552
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                              10⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Modifies registry key
                                              PID:4384
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                              10⤵
                                              • Modifies registry key
                                              PID:4664
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                              10⤵
                                              • UAC bypass
                                              • Modifies registry key
                                              PID:2672
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pQEQUsEY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe""
                                              10⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:1292
                                              • C:\Windows\SysWOW64\cscript.exe
                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                11⤵
                                                • Executes a VBScript file via the Windows Script Host.
                                                • System Location Discovery: System Language Discovery
                                                PID:3636
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                          8⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry key
                                          PID:932
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                          8⤵
                                          • Modifies registry key
                                          PID:2332
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                          8⤵
                                          • UAC bypass
                                          • Modifies registry key
                                          PID:3468
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nsgMkYgc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe""
                                          8⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:4132
                                          • C:\Windows\SysWOW64\cscript.exe
                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                            9⤵
                                            • Executes a VBScript file via the Windows Script Host.
                                            PID:4316
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                      6⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Modifies registry key
                                      PID:5212
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                      6⤵
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry key
                                      PID:1216
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                      6⤵
                                      • UAC bypass
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry key
                                      PID:1068
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mEgEIwQE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe""
                                      6⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:5360
                                      • C:\Windows\SysWOW64\cscript.exe
                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                        7⤵
                                        • Executes a VBScript file via the Windows Script Host.
                                        • System Location Discovery: System Language Discovery
                                        PID:5636
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                  4⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry key
                                  PID:4160
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                  4⤵
                                  • Modifies registry key
                                  PID:2400
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                  4⤵
                                  • UAC bypass
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry key
                                  PID:6064
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uUEwwkMA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe""
                                  4⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:5204
                                  • C:\Windows\SysWOW64\cscript.exe
                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                    5⤵
                                    • Executes a VBScript file via the Windows Script Host.
                                    • System Location Discovery: System Language Discovery
                                    PID:5660
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                              2⤵
                              • Modifies visibility of file extensions in Explorer
                              • Modifies registry key
                              PID:4648
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                              2⤵
                              • System Location Discovery: System Language Discovery
                              • Modifies registry key
                              PID:3476
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                              2⤵
                              • UAC bypass
                              • System Location Discovery: System Language Discovery
                              • Modifies registry key
                              PID:1468
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jYowQgws.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock.exe""
                              2⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:4868
                              • C:\Windows\SysWOW64\cscript.exe
                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                3⤵
                                • Executes a VBScript file via the Windows Script Host.
                                PID:244
                          • C:\ProgramData\CeksswcM\swsMIsoE.exe
                            C:\ProgramData\CeksswcM\swsMIsoE.exe
                            1⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Drops file in System32 directory
                            PID:3328
                          • C:\Users\Admin\CgMQcUoA\BQgEoUoc.exe
                            C:\Users\Admin\CgMQcUoA\BQgEoUoc.exe
                            1⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • System Location Discovery: System Language Discovery
                            PID:2500
                          • C:\ProgramData\KwIAUsEM\FYEAkgww.exe
                            C:\ProgramData\KwIAUsEM\FYEAkgww.exe
                            1⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • System Location Discovery: System Language Discovery
                            PID:1080

                          Network

                                MITRE ATT&CK Enterprise v16

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Execution

                                Command and Scripting Interpreter

                                2
                                T1059

                                Visual Basic

                                1
                                T1059.005

                                Windows Command Shell

                                1
                                T1059.003

                                Persistence

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Privilege Escalation

                                Abuse Elevation Control Mechanism

                                1
                                T1548

                                Bypass User Account Control

                                1
                                T1548.002

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Defense Evasion

                                Abuse Elevation Control Mechanism

                                1
                                T1548

                                Bypass User Account Control

                                1
                                T1548.002

                                Hide Artifacts

                                1
                                T1564

                                Hidden Files and Directories

                                1
                                T1564.001

                                Impair Defenses

                                1
                                T1562

                                Disable or Modify Tools

                                1
                                T1562.001

                                Modify Registry

                                4
                                T1112

                                Credential Access

                                Credentials from Password Stores

                                1
                                T1555

                                Credentials from Web Browsers

                                1
                                T1555.003

                                Unsecured Credentials

                                1
                                T1552

                                Credentials In Files

                                1
                                T1552.001

                                Discovery

                                System Information Discovery

                                1
                                T1082

                                System Location Discovery

                                1
                                T1614

                                System Language Discovery

                                1
                                T1614.001

                                Lateral Movement

                                Collection

                                Data from Local System

                                1
                                T1005

                                Command and Control

                                Exfiltration

                                Impact

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                swsMIsoE.exe
                                • Path C:\ProgramData\CeksswcM\swsMIsoE.exe
                                • Size 1.6MB
                                • SHA256 d7f7f20af70e27fef5c77e853b91bdd8b1ceb20cdd5fe20f54153889c8ba8e54
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                FYEAkgww.exe
                                • Path C:\ProgramData\KwIAUsEM\FYEAkgww.exe
                                • Size 1.6MB
                                • SHA256 917b06f76170423edec65423befc37a5e964f2a67aed5391f247ec30abf1424b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                FYEAkgww.inf
                                • Path C:\ProgramData\KwIAUsEM\FYEAkgww.inf
                                • Size 4B
                                • SHA256 74cd9f450cc3c5a2fee470e793328cd2782c30872bda66e9d2544addf41b30af
                                • MD5 SHA1 SHA512
                                Submit Download

                                FYEAkgww.inf
                                • Path C:\ProgramData\KwIAUsEM\FYEAkgww.inf
                                • Size 4B
                                • SHA256 9d08b267ec4c8f4b6140548f043938783dead180b523c27399f88383d0f09f9d
                                • MD5 SHA1 SHA512
                                Submit Download

                                FYEAkgww.inf
                                • Path C:\ProgramData\KwIAUsEM\FYEAkgww.inf
                                • Size 4B
                                • SHA256 8b864674fc02f2d6a451a0a7b5706cab9f373aa3607fa3bc3885207040416e73
                                • MD5 SHA1 SHA512
                                Submit Download

                                FYEAkgww.inf
                                • Path C:\ProgramData\KwIAUsEM\FYEAkgww.inf
                                • Size 4B
                                • SHA256 292b257b814d33d310ab8cf0e5ac2c147625533f1eb32f4d67bbe2f4a98c500e
                                • MD5 SHA1 SHA512
                                Submit Download

                                gCEY.txt
                                • Path C:\ProgramData\gCEY.txt
                                • Size 9KB
                                • SHA256 cdba811bb5ef7f92177cccf22e3f2ce57adc052d1371d7eb49a60c20815e0964
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock
                                • Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_1f55b176d689410b83321c0a1f12e534_elex_virlock
                                • Size 28KB
                                • SHA256 5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                AIgE.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\AIgE.exe
                                • Size 1.6MB
                                • SHA256 a92bc50e78820e4004a0fc9621a01cf62398d4ad51dafce75a6bac069a820dc8
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                AMka.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\AMka.exe
                                • Size 1.6MB
                                • SHA256 8c4170e005632b075960080eaee3e58db7dc239f003a36770472024115446267
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                AkkY.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\AkkY.exe
                                • Size 1.6MB
                                • SHA256 c78590e51d43433a0cf1356c94cfe0a47aef76dfb0809f06279c6017abfe4b9c
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                CAgm.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\CAgm.exe
                                • Size 2.1MB
                                • SHA256 64e36d7f4ed3971051afa20c14f090ca3b81d94c676b399d4a9aa6fdc2641c1d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                CIwy.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\CIwy.exe
                                • Size 1.9MB
                                • SHA256 579359befb96134de1b4d24ec08c6fbce6e6b678a083d9e33085eaf270700277
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                CMAO.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\CMAO.exe
                                • Size 1.6MB
                                • SHA256 a42943749e05ed053551cc71033f0e9b13d1974643018551cd16febe570b84b1
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                CYIU.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\CYIU.exe
                                • Size 1.6MB
                                • SHA256 329f5c6b42f11725d251271c45accbdfc6293e7eae42e86cc905ba3c872a08da
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                CYoQ.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\CYoQ.exe
                                • Size 1.6MB
                                • SHA256 926aafcf5bf7a4d937e6c927d40fa87344d0a20f5cca878d70430901e4b0a4cc
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                CkMu.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\CkMu.exe
                                • Size 2.0MB
                                • SHA256 c2037ec376e773b228b6c8d1d26e82daf4856b9ecbd58354365af865051b4514
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                EAIU.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\EAIU.exe
                                • Size 1.6MB
                                • SHA256 1dfabde5b9f3a0c5419508278c9db242c79f1fea617b7acd92fcd2190a093458
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                EIIc.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\EIIc.exe
                                • Size 2.0MB
                                • SHA256 837d854868e664e644dc06082f5a49025b7c29c89212220d98d39705d0242205
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                EMoM.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\EMoM.exe
                                • Size 1.6MB
                                • SHA256 07f3c536b63bcad51fa9e18c303bb750005d07e1345a8f742099e919247be557
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                EYcy.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\EYcy.exe
                                • Size 2.8MB
                                • SHA256 0238bbee93f6af21a41d6268d0e4bdb12b82d1a911598d4d83951ef0e0a738f2
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                EYgK.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\EYgK.exe
                                • Size 1.8MB
                                • SHA256 f58048df8c440d830190fb845a1b29e66aa41b3fd568d14aad7bd8adcd6f2267
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                EwEy.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\EwEy.exe
                                • Size 1.9MB
                                • SHA256 2d1416487c50e02ca73fee6dc128635e3e1a5ff0234882149f41a4d07a4bb384
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Gswc.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\Gswc.exe
                                • Size 1.6MB
                                • SHA256 b60669a438b9f9b49c0b8ab69e8ce0dae740da558c81334acc6b07de7ebd4ced
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                IkIu.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\IkIu.exe
                                • Size 1.8MB
                                • SHA256 10452cc4bda1cac3dfcdb4d952e7aae87797b7a48ac58f1410fc397945e3557a
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                IkoI.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\IkoI.exe
                                • Size 1.8MB
                                • SHA256 ba9271636630bccc3ad8902ee9adb8dbb8136c26dfcdb4d45dd912b914bf6dc3
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                IscQ.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\IscQ.exe
                                • Size 2.2MB
                                • SHA256 00de733229b97f56bd2c384d4b8c6383cabf63f316390e480294da6ee890616f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                IwQW.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\IwQW.exe
                                • Size 1.6MB
                                • SHA256 c2faa3dafaaee96f501ee565efef657ad56ddee89d073e57ca95a91597df04e8
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                KEwy.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\KEwy.exe
                                • Size 1.6MB
                                • SHA256 afd61bc8369566998aad32ca923b47309bd731cf4e8c8c4235ae8c32e8ad1d74
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                KcAu.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\KcAu.exe
                                • Size 1.9MB
                                • SHA256 fc2ab7fd91164114e9056ba1224d869e442cbd814898704f2e3d356d08f7a7bd
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                KgwI.ico
                                • Path C:\Users\Admin\AppData\Local\Temp\KgwI.ico
                                • Size 4KB
                                • SHA256 e1131246c60ad423586203bb8b9287e365051101ddbf532132bd47ef03ab86c8
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                KsAy.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\KsAy.exe
                                • Size 1.6MB
                                • SHA256 93d558900ea07052f61f3025f48d219a41447ce78d154cdad111964148d5fe81
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                MEgu.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\MEgu.exe
                                • Size 2.1MB
                                • SHA256 b79598071f7ce54b81c2ebd19bbfa638f8e957f726dfca741a92f84497601ca8
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                MIAy.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\MIAy.exe
                                • Size 1.9MB
                                • SHA256 4a8a970f5d2f6dc3554901a14d944cf7ac7a99a69051124674a50d7347c3622d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                MQEw.ico
                                • Path C:\Users\Admin\AppData\Local\Temp\MQEw.ico
                                • Size 4KB
                                • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Mgsy.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\Mgsy.exe
                                • Size 2.1MB
                                • SHA256 3efff07b8e4209a3f36f82568c91edaa5c6cae1975fc77af2200042abbde16cf
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                MsYK.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\MsYK.exe
                                • Size 1.6MB
                                • SHA256 a4eba6a0f2f5412dad3d6a8c95307d89634f738f8003d90e498c5f637e269ff0
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                OoUe.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\OoUe.exe
                                • Size 1.6MB
                                • SHA256 32f92f4ed65977ac94b364dca02b83faad55e3fba3eeac029ed696061907718c
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Oosa.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\Oosa.exe
                                • Size 1.6MB
                                • SHA256 f9fbafeeb1097a1c01a09f92f4d9f8798558d603a81babbb7b1077180de0f7e6
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                OqYQ.ico
                                • Path C:\Users\Admin\AppData\Local\Temp\OqYQ.ico
                                • Size 4KB
                                • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Osgg.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\Osgg.exe
                                • Size 2.0MB
                                • SHA256 1a529a20aeab12b1957ad53bec86f5083805d9e925a687557e448281f9da45d9
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                QIgW.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\QIgW.exe
                                • Size 1.9MB
                                • SHA256 5b430014ee8a080be114a9f2e9daa914780e1cdfa86e5fc071853c900c767e70
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                QMAk.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\QMAk.exe
                                • Size 1.8MB
                                • SHA256 8d5278a39b10b3628406a3ada542fffc0fb5e26b7427724596156c03499c6e78
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Qggk.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\Qggk.exe
                                • Size 1.6MB
                                • SHA256 c69259ab73d424b3337938ec02cf614ade7a78938bc42b98716ff4e10d4d435d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                QkMo.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\QkMo.exe
                                • Size 1.6MB
                                • SHA256 1f9e96d3e92c7622281db06c596f375a3b03c9d2d7482541e5cc331a223d4e2e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Qkwc.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\Qkwc.exe
                                • Size 2.7MB
                                • SHA256 05b1c223f08c3342fca0b0f6303e7e19bb70a542c7d08a97e9fef801ba08b3a0
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                QsEY.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\QsEY.exe
                                • Size 1.6MB
                                • SHA256 f7b39dba589685e6c781251ba61da6d44639653728accc598cb6c18c53c8191d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                SEgG.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\SEgG.exe
                                • Size 1.6MB
                                • SHA256 ca6454512b04cb7b39fbc65486d99ad264488a11a7ec43e9339a20f6498f090e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                SgUw.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\SgUw.exe
                                • Size 2.8MB
                                • SHA256 2277c5ca1444292a6f81de631076d8563436440b22db9d72e038b4c07eefa285
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                SkIc.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\SkIc.exe
                                • Size 1.6MB
                                • SHA256 eef0c2c5657ba1de92d45901b7745de0cd01b26c80b348cb2ec81e9577136212
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                SoAu.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\SoAu.exe
                                • Size 1.8MB
                                • SHA256 c9c148b73572e4fb42d613c9d6c8a976e091c9ac11d2a55ad7dd5d2b2cd86770
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                SwMm.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\SwMm.exe
                                • Size 2.4MB
                                • SHA256 b71f82156b6902fe3d22b367b186f402c27332fac80f05f76c646752f0f5abdb
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                SwUe.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\SwUe.exe
                                • Size 2.0MB
                                • SHA256 ff7d447a2875ddc43c46af4533a2acaa6524b6de7e1fd82ea03029ade26fe6bd
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                UQcq.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\UQcq.exe
                                • Size 1.6MB
                                • SHA256 52010af9b00135f8050492f6ec5bdb0f23f3e736ced99d5e8c309315750442ec
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                UkAu.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\UkAu.exe
                                • Size 1.8MB
                                • SHA256 ea6f0150555016df3a91aa76861106caf26368cbdccc0e0d195a7aaf425e97e6
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Ukoq.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\Ukoq.exe
                                • Size 1.9MB
                                • SHA256 929f6f5a7bd2cdf30e166cc290ecf0c9c8c81b190a7a4d3d6b07b2f7d360f40d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                WMoS.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\WMoS.exe
                                • Size 1.9MB
                                • SHA256 0ce39857e0bc1fab69584019e0f66914151ed6e3aa068b8cee6247d6ed654adb
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                WQUy.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\WQUy.exe
                                • Size 2.3MB
                                • SHA256 42a6123af4f304d8ea66623094abc12812d9b47f3036107e837dfd63da19b859
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Wgsi.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\Wgsi.exe
                                • Size 1.9MB
                                • SHA256 0e460a777a977810ad1056080068a02151050111e5d877908dc1768986482983
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                WkoK.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\WkoK.exe
                                • Size 2.2MB
                                • SHA256 677de681d0fd33d50c3ae1d6679be0d4b9e21d400cbbafae5020b3ab07794c92
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                WsIe.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\WsIe.exe
                                • Size 2.4MB
                                • SHA256 8c8fe3278516c7b966ec406c37846d28d061a9ae3c6b5c7861519be0588409e8
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                YAoM.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\YAoM.exe
                                • Size 1.9MB
                                • SHA256 376b270b517ef2fad83b2d2397c1981ce04dbe9fb83c1d24809328636418fcf0
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                YIUY.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\YIUY.exe
                                • Size 2.9MB
                                • SHA256 fcbcbd03d4ddbfd0cb6b30eb1ff0bd90508f222a3e45586a35f3bf77dd644d66
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                YIoo.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\YIoo.exe
                                • Size 1.9MB
                                • SHA256 32ecc703e07a60af68cc9adc912127f7414e515967bd2e482298b32e1ac606d9
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                YIsY.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\YIsY.exe
                                • Size 1.7MB
                                • SHA256 e5bef394145fd70107ab9a3290b9c87e69c5f0b29ea1bf3308449cd1182e3dfe
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                YMkS.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\YMkS.exe
                                • Size 3.1MB
                                • SHA256 7b28b3b69dee4c84f176063daf5b8f08dd0e9ee547ceaff5232a7004fc235de0
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                YQso.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\YQso.exe
                                • Size 2.1MB
                                • SHA256 25505500040cc85cb4d38867c46be4ebce772ac29a4f8e286fbd3cc502a53fba
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                YgMs.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\YgMs.exe
                                • Size 1.6MB
                                • SHA256 6ab2c79437f7f0ef2e4dcfaef8231c77e335c97a3fdb764ce0395bcd00f259b7
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Ywce.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\Ywce.exe
                                • Size 2.2MB
                                • SHA256 2d3dfa98b423bdc87aa5162e41cfa3b4b33f904a4c64245ba601c2ce33f2169b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Ywsm.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\Ywsm.exe
                                • Size 2.2MB
                                • SHA256 b225860864a64eba99d6135c5a57384163b89bc5ee12c37c645a38ff1ac1f1ea
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Ywwa.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\Ywwa.exe
                                • Size 2.1MB
                                • SHA256 97eb52b4502a68a24bfc282398cac524c5d738dc948e2fbe5bbf6f98bda03d6e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                aEAs.ico
                                • Path C:\Users\Admin\AppData\Local\Temp\aEAs.ico
                                • Size 4KB
                                • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                aYMI.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\aYMI.exe
                                • Size 1.8MB
                                • SHA256 5ecf571ba1184993be8180c64cf0312d0cb333f992b1f6dc5e7cb270135f3cf4
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                acMG.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\acMG.exe
                                • Size 1.7MB
                                • SHA256 57f1d313321f7a76fb85b07d591b9043dd5b33695ea73158c29801584e77ebc5
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                agYK.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\agYK.exe
                                • Size 2.5MB
                                • SHA256 9b592ec24ea17ef6997d859b719f04169562f71afe940a226380fb5963e9b6f3
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                akgI.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\akgI.exe
                                • Size 1.6MB
                                • SHA256 0397ec57bafbaefb4a2350b8a31a6853ead15513029e62216eebfc2a741ec5ff
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                awwk.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\awwk.exe
                                • Size 1.7MB
                                • SHA256 4e51ea414af92388a7714d6e406ca427bb2783ce5b8ca5cc8cc6d0bf93e9826e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                cMgi.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\cMgi.exe
                                • Size 2.2MB
                                • SHA256 6956b3ed9f11500245116661a7e9d85629ac76036b2c8eff485d1b0dbe55b814
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                cUEa.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\cUEa.exe
                                • Size 2.4MB
                                • SHA256 74b7c59e8bb2ae8bea0135ab87baf349b3dc0984fee6754c91a0bce9d58a8b57
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                cYEg.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\cYEg.exe
                                • Size 2.1MB
                                • SHA256 8cb52f575280e5bc17832ef4c91061347c4cefd7f798a4f8d6e0ce2742e3d1bf
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ckIY.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\ckIY.exe
                                • Size 2.0MB
                                • SHA256 c24af0e6e79335a21c4a6c4a32b01bbda1737f3ea1882351c77545363f87bd06
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                csoy.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\csoy.exe
                                • Size 1.9MB
                                • SHA256 26e51330a0703cf1ad2b3fb8575d221809fab584ec11d7ca6d18f2e6c5bb7c3b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                eMks.ico
                                • Path C:\Users\Admin\AppData\Local\Temp\eMks.ico
                                • Size 4KB
                                • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                eYsM.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\eYsM.exe
                                • Size 2.0MB
                                • SHA256 8e94ecbb2cca0977bad1bce2618531bb2965a5080faa5ad11e391580aeb7369e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                eksw.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\eksw.exe
                                • Size 1.9MB
                                • SHA256 18f140a38d74e10f7bef7b6aa71f9e8c2c4a6d82d58e9dbff701ccd929d10762
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                file.vbs
                                • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                • Size 19B
                                • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                • MD5 SHA1 SHA512
                                Submit Download

                                gAAU.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\gAAU.exe
                                • Size 2.0MB
                                • SHA256 0e2293e28f9bd586af33bb439c3d5205fe88d5978934957ccf28181a00f80482
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                gEgA.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\gEgA.exe
                                • Size 1.9MB
                                • SHA256 a346b08607fe91a283244d516ac63389e7c3e24b6b3666a9756e4029c0401b2e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                iUce.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\iUce.exe
                                • Size 1.6MB
                                • SHA256 be56dc1a4760628bc7d328e7de6af8b815b661e567092bf23a44590deac49349
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                isgQ.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\isgQ.exe
                                • Size 2.0MB
                                • SHA256 23b9a9df19b4ddfc44c0aa02079b5e05f02e588192f466d198fb6198815f27d2
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                isoe.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\isoe.exe
                                • Size 1.6MB
                                • SHA256 f1ab777891f1da09f05fbc09c1672cb1408c0fc8f768bbc77d653ee73cf3463c
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                iwQE.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\iwQE.exe
                                • Size 1.6MB
                                • SHA256 58c1f5b8267b95e524edfa8a50b6719bd5c1b48726fff1f1b25d3cc706a58b2f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                jYowQgws.bat
                                • Path C:\Users\Admin\AppData\Local\Temp\jYowQgws.bat
                                • Size 112B
                                • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                kAQG.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\kAQG.exe
                                • Size 2.3MB
                                • SHA256 57e7d86103b093864695fb7479897440b5db76c4af06ef29be86a9242f52599b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                kQUy.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\kQUy.exe
                                • Size 1.8MB
                                • SHA256 4ae97f9eccab663994f4cc0a686a8d4e208dcefaec25c378468d8822d2675dd3
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                kgwW.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\kgwW.exe
                                • Size 1.6MB
                                • SHA256 1ba072da3471740851f85ae9583ea265eb9c1a720240a9e9bcfbfc6476cf76b5
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                kkQg.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\kkQg.exe
                                • Size 1.9MB
                                • SHA256 66b073d520785636448a376664a8e1db6084c24552e7e2384981b1fc56af0bfb
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                kkca.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\kkca.exe
                                • Size 1.8MB
                                • SHA256 180b729362fcf694a43ff1ac6bb485b666da0260205c0f25313c11e53f905736
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                meUw.ico
                                • Path C:\Users\Admin\AppData\Local\Temp\meUw.ico
                                • Size 4KB
                                • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                mgYE.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\mgYE.exe
                                • Size 1.6MB
                                • SHA256 58081df1ebff74c044b1d47042c2644fb9209a564662dd96fb925b945767b60b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                moQG.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\moQG.exe
                                • Size 1.6MB
                                • SHA256 11e2061995c7090ff80fbd99a6937e9fc86a4f8e14a03ba4a6ed33c7b2b0275e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                moog.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\moog.exe
                                • Size 2.0MB
                                • SHA256 d22dc3178121c8b32a14643f21f8923c64d34cc8844b0f61dfe5e74eddac31da
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                moss.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\moss.exe
                                • Size 1.7MB
                                • SHA256 85b65145f7bfd2fbb686758cb7bd5a67e6681227cb70d409c57483ecb8cfeb7e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                mwso.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\mwso.exe
                                • Size 1.6MB
                                • SHA256 18333a40fbbe26a4900457f7e958cc3582af26de452a57c28f83eccecdd04402
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                oQMG.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\oQMG.exe
                                • Size 1.6MB
                                • SHA256 7a876885b824cc3055061ddb58bfa66358bd0b313604913f4a389047052912cb
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                oUoc.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\oUoc.exe
                                • Size 1.6MB
                                • SHA256 e5530ca598c5feda8143019ef4723ffe10b535df5f06211d1885b83ecdff9315
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                qUAQ.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\qUAQ.exe
                                • Size 1.8MB
                                • SHA256 f617b6754406d67a1ea166fe9c90ffc3d5998d02ac729f9fd87cfb8fe7aa7336
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                qkAA.ico
                                • Path C:\Users\Admin\AppData\Local\Temp\qkAA.ico
                                • Size 4KB
                                • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                qsoe.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\qsoe.exe
                                • Size 1.7MB
                                • SHA256 a71fc670eec15b535f4041092bdcab8bf57ba8697c06cf8973453e7d469f6d7a
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                sgoI.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\sgoI.exe
                                • Size 1.7MB
                                • SHA256 db9fb44d0e1c8c6d29360a65d0d1a1676236723a1bbe4145df551315eb9b6427
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                skAE.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\skAE.exe
                                • Size 1.9MB
                                • SHA256 175510057247ca60e97fe22ec2850a917d7b7c1eebb3828ea28512e2bbd37611
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                soAi.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\soAi.exe
                                • Size 1.6MB
                                • SHA256 dd8b5c4a59ec01f0cd32a01a058d0c6af93b600dcb16a91ab9c932f41b1e6470
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ssoY.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\ssoY.exe
                                • Size 1.6MB
                                • SHA256 06800d9cae15e6a648b5f1d44579a555a587e83c728f3491b6d79bea888b6ca0
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                suIc.ico
                                • Path C:\Users\Admin\AppData\Local\Temp\suIc.ico
                                • Size 4KB
                                • SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                uIMS.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\uIMS.exe
                                • Size 1.6MB
                                • SHA256 56db1bff3c779f86420df8614bc5f3957f20192bc4a17ba51aeabb5155b9a4ff
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ugkM.ico
                                • Path C:\Users\Admin\AppData\Local\Temp\ugkM.ico
                                • Size 4KB
                                • SHA256 114dae4c54ca426f78e50998727dac92942261d71ca5b2dbaf413794dcf8ad82
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ugkg.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\ugkg.exe
                                • Size 2.0MB
                                • SHA256 73a4429890a23919c9402198ea6c2a3a9f17deddba971c393cee72b655c3ff92
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ukUg.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\ukUg.exe
                                • Size 1.8MB
                                • SHA256 d10fc49fc00a068c028626c63502fca392e18974525083bb556fce11c81722d8
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ukYm.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\ukYm.exe
                                • Size 1.9MB
                                • SHA256 3e13d15f2ca17929ae23dcc68dd9743a506c555d4b475fa10c5d8f28cbdf2a2b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                wAIU.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\wAIU.exe
                                • Size 1.7MB
                                • SHA256 646035dda7d1b5893cc4fce3f902b59722121800db76de6be175a95f12fd5bc0
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                wMgI.ico
                                • Path C:\Users\Admin\AppData\Local\Temp\wMgI.ico
                                • Size 4KB
                                • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                wcgO.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\wcgO.exe
                                • Size 2.2MB
                                • SHA256 4b6bdb518ccf68544a99bc8ed3cbba5cd26b1a91b2d089c05edfcb1e35760a7c
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                wyUU.ico
                                • Path C:\Users\Admin\AppData\Local\Temp\wyUU.ico
                                • Size 4KB
                                • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                yEQg.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\yEQg.exe
                                • Size 1.9MB
                                • SHA256 ededdcf3d39a1c26d63522b3f2b90a7a2fa045215b758423000d210adda51210
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                yIgK.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\yIgK.exe
                                • Size 3.6MB
                                • SHA256 183d671e8be67687be6bfea62550fd95290fdd1a556b3719fadf92398f3eba68
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                yYMO.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\yYMO.exe
                                • Size 2.2MB
                                • SHA256 3885d832c9cda8128bb85c6b03441c4fd39064660795bbdf4585e5937111290e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ycMq.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\ycMq.exe
                                • Size 2.3MB
                                • SHA256 a4e9ef206e8cb348ce772d6c8b74b286836125c0f686b87bee5a0981b8a5cb60
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                yoQq.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\yoQq.exe
                                • Size 2.9MB
                                • SHA256 f3484b85347a8d5884808b3f4c968a675ec576bea543f448e3aa79146e9b4ff9
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                BQgEoUoc.exe
                                • Path C:\Users\Admin\CgMQcUoA\BQgEoUoc.exe
                                • Size 1.6MB
                                • SHA256 d7e678a11a8829e6ffd5a86f1119ef441f6e2668cedbb2e11889ba421df856e2
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                BQgEoUoc.inf
                                • Path C:\Users\Admin\CgMQcUoA\BQgEoUoc.inf
                                • Size 4B
                                • SHA256 ef7abf0d013906874a24f3d58d755d861ee2b60db6992ede4fdb6427d44e3e3b
                                • MD5 SHA1 SHA512
                                Submit Download

                                BQgEoUoc.inf
                                • Path C:\Users\Admin\CgMQcUoA\BQgEoUoc.inf
                                • Size 4B
                                • SHA256 1dd1bd8e3634c1b8e679ad012bb3ffd7728b68ea98fb94e7681a76054eab5312
                                • MD5 SHA1 SHA512
                                Submit Download

                                BQgEoUoc.inf
                                • Path C:\Users\Admin\CgMQcUoA\BQgEoUoc.inf
                                • Size 4B
                                • SHA256 b6e64b302a504834b23cc673e28fd6d9d2d1950cf93b40ddfbb0be80e5e305f5
                                • MD5 SHA1 SHA512
                                Submit Download

                                memory/1080-1807-0x0000000000400000-0x000000000058F000-memory.dmp
                                Download

                                memory/1080-39-0x0000000000400000-0x000000000058F000-memory.dmp
                                Download

                                memory/1140-171-0x0000000000400000-0x0000000000598000-memory.dmp
                                Download

                                memory/1432-259-0x0000000000400000-0x0000000000598000-memory.dmp
                                Download

                                memory/1464-185-0x0000000000400000-0x0000000000598000-memory.dmp
                                Download

                                memory/1816-279-0x0000000000400000-0x0000000000598000-memory.dmp
                                Download

                                memory/2500-1798-0x0000000000400000-0x0000000000590000-memory.dmp
                                Download

                                memory/2616-52-0x0000000000400000-0x0000000000598000-memory.dmp
                                Download

                                memory/2856-141-0x0000000000400000-0x0000000000598000-memory.dmp
                                Download

                                memory/2936-70-0x0000000000400000-0x0000000000598000-memory.dmp
                                Download

                                memory/2980-201-0x0000000000400000-0x0000000000598000-memory.dmp
                                Download

                                memory/3328-19-0x0000000000400000-0x0000000000590000-memory.dmp
                                Download

                                memory/3328-1789-0x0000000000400000-0x0000000000590000-memory.dmp
                                Download

                                memory/3880-82-0x0000000000400000-0x0000000000598000-memory.dmp
                                Download

                                memory/4148-228-0x0000000000400000-0x0000000000598000-memory.dmp
                                Download

                                memory/4192-271-0x0000000000400000-0x0000000000598000-memory.dmp
                                Download

                                memory/4208-126-0x0000000000400000-0x0000000000598000-memory.dmp
                                Download

                                memory/4324-31-0x00000000021F0000-0x0000000002210000-memory.dmp
                                Download

                                memory/4324-0-0x0000000000400000-0x0000000000598000-memory.dmp
                                Download

                                memory/4324-30-0x0000000000400000-0x0000000000598000-memory.dmp
                                Download

                                memory/4324-1-0x00000000021F0000-0x0000000002210000-memory.dmp
                                Download

                                memory/4364-154-0x0000000000400000-0x0000000000598000-memory.dmp
                                Download

                                memory/4364-137-0x0000000000400000-0x0000000000598000-memory.dmp
                                Download

                                memory/4472-240-0x0000000000400000-0x0000000000598000-memory.dmp
                                Download

                                memory/4648-249-0x0000000000400000-0x0000000000598000-memory.dmp
                                Download

                                memory/4652-111-0x0000000000400000-0x0000000000598000-memory.dmp
                                Download

                                memory/4728-95-0x0000000000400000-0x0000000000598000-memory.dmp
                                Download

                                memory/5024-1784-0x0000000000400000-0x000000000058F000-memory.dmp
                                Download

                                memory/5024-16-0x0000000000400000-0x000000000058F000-memory.dmp
                                Download

                                memory/5152-10-0x0000000000400000-0x0000000000590000-memory.dmp
                                Download

                                memory/5152-1597-0x0000000000A40000-0x0000000000A60000-memory.dmp
                                Download

                                memory/5152-1779-0x0000000000400000-0x0000000000590000-memory.dmp
                                Download

                                memory/5152-289-0x0000000000A40000-0x0000000000A60000-memory.dmp
                                Download

                                memory/5772-212-0x0000000000400000-0x0000000000598000-memory.dmp
                                Download