Overview

overview

10

Static

static

3

2026-06-30...ck.exe

windows10-2004-x64

10

2026-06-30...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 00:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe
  • Size 1.6MB
  • Sample260701-ap826abs8m
  • SHA256 7790a25b8691818a7c0f8f07f2433658fe33e45e8280e20d44721259857a4aae
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverynabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 17 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 17 IoCs
    defense_evasiontrojan
  • Renames multiple (120) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 9 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 51 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2608
    • C:\Users\Admin\GCMcEIkI\lMYAkogU.exe
      "C:\Users\Admin\GCMcEIkI\lMYAkogU.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:6104
    • C:\ProgramData\YIwIwgoc\MEYEYQUo.exe
      "C:\ProgramData\YIwIwgoc\MEYEYQUo.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:5664
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4468
      • C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5056
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1896
          • C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:6088
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:52
              • C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1752
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3396
                  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:5456
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock"
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:4264
                      • C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:3312
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock"
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4892
                          • C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:2288
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock"
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5472
                              • C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock
                                15⤵
                                • Adds Run key to start application
                                PID:5440
                                • C:\Users\Admin\BSQkQsEk\acsEAQYg.exe
                                  "C:\Users\Admin\BSQkQsEk\acsEAQYg.exe"
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4952
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 264
                                    17⤵
                                    • Program crash
                                    PID:4216
                                • C:\ProgramData\EUQwsAME\CkgUwkUs.exe
                                  "C:\ProgramData\EUQwsAME\CkgUwkUs.exe"
                                  16⤵
                                    PID:4644
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 268
                                      17⤵
                                      • Program crash
                                      PID:2108
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock"
                                    16⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:1100
                                    • C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe
                                      C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock
                                      17⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:4268
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock"
                                        18⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:2964
                                        • C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe
                                          C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock
                                          19⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of WriteProcessMemory
                                          PID:4704
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock"
                                            20⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:3612
                                            • C:\Windows\System32\Conhost.exe
                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              21⤵
                                                PID:2176
                                              • C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe
                                                C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock
                                                21⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:3932
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock"
                                                  22⤵
                                                    PID:4580
                                                    • C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe
                                                      C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock
                                                      23⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5424
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock"
                                                        24⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:5264
                                                        • C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe
                                                          C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock
                                                          25⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:2680
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock"
                                                            26⤵
                                                              PID:4840
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe
                                                                C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock
                                                                27⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:2992
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock"
                                                                  28⤵
                                                                    PID:4896
                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock
                                                                      29⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:3856
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock"
                                                                        30⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:2408
                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock
                                                                          31⤵
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:5436
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock"
                                                                            32⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:728
                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock
                                                                              33⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:2532
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock"
                                                                                34⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:3216
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                34⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Modifies registry key
                                                                                PID:5180
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                34⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Modifies registry key
                                                                                PID:2704
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                34⤵
                                                                                • UAC bypass
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Modifies registry key
                                                                                PID:6128
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\USEcYcEM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe""
                                                                                34⤵
                                                                                  PID:5288
                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                    35⤵
                                                                                      PID:5036
                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                      35⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:624
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                32⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Modifies registry key
                                                                                PID:1272
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                32⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Modifies registry key
                                                                                PID:4788
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                32⤵
                                                                                • UAC bypass
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Modifies registry key
                                                                                PID:4084
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PywQMkEs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe""
                                                                                32⤵
                                                                                  PID:1312
                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                    33⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:4984
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                              30⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies registry key
                                                                              PID:1972
                                                                              • C:\Windows\System32\Conhost.exe
                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                31⤵
                                                                                  PID:5956
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                30⤵
                                                                                • Modifies registry key
                                                                                PID:1672
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                30⤵
                                                                                • UAC bypass
                                                                                • Modifies registry key
                                                                                PID:4216
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ougMYogs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe""
                                                                                30⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:4812
                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                  31⤵
                                                                                    PID:760
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                              28⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Modifies registry key
                                                                              PID:1220
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                              28⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies registry key
                                                                              PID:800
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                              28⤵
                                                                              • UAC bypass
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies registry key
                                                                              PID:828
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RMwEQIUQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe""
                                                                              28⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2808
                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                29⤵
                                                                                  PID:2372
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                            26⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Modifies registry key
                                                                            PID:1636
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                            26⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Modifies registry key
                                                                            PID:3444
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                            26⤵
                                                                            • UAC bypass
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Modifies registry key
                                                                            PID:2728
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JkwUwYgk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe""
                                                                            26⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:3956
                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                              27⤵
                                                                                PID:1996
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                          24⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Modifies registry key
                                                                          PID:4464
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                          24⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Modifies registry key
                                                                          PID:5276
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                          24⤵
                                                                          • UAC bypass
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Modifies registry key
                                                                          PID:5956
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zmIYIcsM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe""
                                                                          24⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2008
                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                            25⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:4408
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                      22⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Modifies registry key
                                                                      PID:5712
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                      22⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies registry key
                                                                      PID:4640
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                      22⤵
                                                                      • UAC bypass
                                                                      • Modifies registry key
                                                                      PID:3812
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VgcUgMQA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe""
                                                                      22⤵
                                                                        PID:2360
                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                          23⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:1116
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                    20⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies registry key
                                                                    PID:4824
                                                                    • C:\Windows\System32\Conhost.exe
                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      21⤵
                                                                        PID:572
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                      20⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies registry key
                                                                      PID:5448
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                      20⤵
                                                                      • UAC bypass
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies registry key
                                                                      PID:3920
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gesIwQQE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe""
                                                                      20⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4356
                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                        21⤵
                                                                          PID:2512
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                    18⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • Modifies registry key
                                                                    PID:3372
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                    18⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies registry key
                                                                    PID:1080
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                    18⤵
                                                                    • UAC bypass
                                                                    • Modifies registry key
                                                                    PID:3184
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eqskckgs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe""
                                                                    18⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:620
                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                      19⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4080
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                16⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • System Location Discovery: System Language Discovery
                                                                • Modifies registry key
                                                                PID:1304
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                16⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Modifies registry key
                                                                PID:5588
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                16⤵
                                                                • UAC bypass
                                                                • Modifies registry key
                                                                PID:2792
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\naUEQcII.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe""
                                                                16⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5592
                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                  17⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:5768
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                            14⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Modifies registry key
                                                            PID:4464
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                            14⤵
                                                            • Modifies registry key
                                                            PID:5600
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                            14⤵
                                                            • UAC bypass
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry key
                                                            PID:3040
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZQgcsMgg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe""
                                                            14⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3860
                                                            • C:\Windows\SysWOW64\cscript.exe
                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                              15⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2788
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                        12⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry key
                                                        PID:904
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                        12⤵
                                                        • Modifies registry key
                                                        PID:5012
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                        12⤵
                                                        • UAC bypass
                                                        • Modifies registry key
                                                        PID:5036
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oaAUEgYs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe""
                                                        12⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5408
                                                        • C:\Windows\SysWOW64\cscript.exe
                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                          13⤵
                                                            PID:6064
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                      10⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Modifies registry key
                                                      PID:2028
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                      10⤵
                                                      • Modifies registry key
                                                      PID:3940
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                      10⤵
                                                      • UAC bypass
                                                      • Modifies registry key
                                                      PID:572
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AkUcsgUs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe""
                                                      10⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2352
                                                      • C:\Windows\SysWOW64\cscript.exe
                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                        11⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:4456
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                  8⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Modifies registry key
                                                  PID:2176
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                  8⤵
                                                  • Modifies registry key
                                                  PID:2368
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                  8⤵
                                                  • UAC bypass
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry key
                                                  PID:5768
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OcsEcUwA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe""
                                                  8⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4948
                                                  • C:\Windows\SysWOW64\cscript.exe
                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                    9⤵
                                                      PID:4460
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                6⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Modifies registry key
                                                PID:124
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                6⤵
                                                • Modifies registry key
                                                PID:240
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                6⤵
                                                • UAC bypass
                                                • Modifies registry key
                                                PID:2680
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jSwcwgQw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe""
                                                6⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:5348
                                                • C:\Windows\SysWOW64\cscript.exe
                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                  7⤵
                                                    PID:1384
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                              4⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Modifies registry key
                                              PID:5452
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                              4⤵
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry key
                                              PID:2864
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                              4⤵
                                              • UAC bypass
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry key
                                              PID:4304
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vukUMwUA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe""
                                              4⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:2848
                                              • C:\Windows\SysWOW64\cscript.exe
                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                5⤵
                                                  PID:976
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                            2⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry key
                                            PID:6044
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                            2⤵
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry key
                                            PID:2616
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                            2⤵
                                            • UAC bypass
                                            • Modifies registry key
                                            PID:5356
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ykIIkgMw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock.exe""
                                            2⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:4660
                                            • C:\Windows\SysWOW64\cscript.exe
                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                              3⤵
                                                PID:4768
                                          • C:\ProgramData\woUkYoIA\TwEsUEEs.exe
                                            C:\ProgramData\woUkYoIA\TwEsUEEs.exe
                                            1⤵
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            PID:5800
                                          • C:\ProgramData\YIwIwgoc\MEYEYQUo.exe
                                            C:\ProgramData\YIwIwgoc\MEYEYQUo.exe
                                            1⤵
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            PID:1244
                                          • C:\Users\Admin\GCMcEIkI\lMYAkogU.exe
                                            C:\Users\Admin\GCMcEIkI\lMYAkogU.exe
                                            1⤵
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • Drops file in System32 directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of FindShellTrayWindow
                                            PID:5224
                                          • C:\ProgramData\KkQswIQA\VKcccsQk.exe
                                            C:\ProgramData\KkQswIQA\VKcccsQk.exe
                                            1⤵
                                              PID:5200
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5200 -s 264
                                                2⤵
                                                • Program crash
                                                PID:2616
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4644 -ip 4644
                                              1⤵
                                                PID:5780
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4952 -ip 4952
                                                1⤵
                                                  PID:1148
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5200 -ip 5200
                                                  1⤵
                                                    PID:1548
                                                  • C:\Users\Admin\BSQkQsEk\acsEAQYg.exe
                                                    C:\Users\Admin\BSQkQsEk\acsEAQYg.exe
                                                    1⤵
                                                      PID:2956
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 232
                                                        2⤵
                                                        • Program crash
                                                        PID:6016
                                                    • C:\ProgramData\EUQwsAME\CkgUwkUs.exe
                                                      C:\ProgramData\EUQwsAME\CkgUwkUs.exe
                                                      1⤵
                                                        PID:4936
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2956 -ip 2956
                                                        1⤵
                                                          PID:4304
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4936 -ip 4936
                                                          1⤵
                                                            PID:1756

                                                          Network

                                                                MITRE ATT&CK Enterprise v16

                                                                Reconnaissance

                                                                Resource Development

                                                                Initial Access

                                                                Execution

                                                                Persistence

                                                                Boot or Logon Autostart Execution

                                                                1
                                                                T1547

                                                                Registry Run Keys / Startup Folder

                                                                1
                                                                T1547.001

                                                                Privilege Escalation

                                                                Abuse Elevation Control Mechanism

                                                                1
                                                                T1548

                                                                Bypass User Account Control

                                                                1
                                                                T1548.002

                                                                Boot or Logon Autostart Execution

                                                                1
                                                                T1547

                                                                Registry Run Keys / Startup Folder

                                                                1
                                                                T1547.001

                                                                Defense Evasion

                                                                Abuse Elevation Control Mechanism

                                                                1
                                                                T1548

                                                                Bypass User Account Control

                                                                1
                                                                T1548.002

                                                                Hide Artifacts

                                                                1
                                                                T1564

                                                                Hidden Files and Directories

                                                                1
                                                                T1564.001

                                                                Impair Defenses

                                                                1
                                                                T1562

                                                                Disable or Modify Tools

                                                                1
                                                                T1562.001

                                                                Modify Registry

                                                                4
                                                                T1112

                                                                Credential Access

                                                                Credentials from Password Stores

                                                                1
                                                                T1555

                                                                Credentials from Web Browsers

                                                                1
                                                                T1555.003

                                                                Unsecured Credentials

                                                                1
                                                                T1552

                                                                Credentials In Files

                                                                1
                                                                T1552.001

                                                                Discovery

                                                                System Information Discovery

                                                                1
                                                                T1082

                                                                System Location Discovery

                                                                1
                                                                T1614

                                                                System Language Discovery

                                                                1
                                                                T1614.001

                                                                Lateral Movement

                                                                Collection

                                                                Data from Local System

                                                                1
                                                                T1005

                                                                Command and Control

                                                                Exfiltration

                                                                Impact

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                MEYEYQUo.exe
                                                                • Path C:\ProgramData\YIwIwgoc\MEYEYQUo.exe
                                                                • Size 1.6MB
                                                                • SHA256 8e35360fde2f6c2d2c6eee04d6808ea40f47884e1a1d8118a0b837bd35c065e7
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                MEYEYQUo.inf
                                                                • Path C:\ProgramData\YIwIwgoc\MEYEYQUo.inf
                                                                • Size 4B
                                                                • SHA256 a39292198f33a6c646f43bd98ff8e9677008ea0b50666c7e1cbe467a37b10422
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                MEYEYQUo.inf
                                                                • Path C:\ProgramData\YIwIwgoc\MEYEYQUo.inf
                                                                • Size 4B
                                                                • SHA256 6ef2dc0850268c57141e6f4179bfd7b6d06b5173b45f3517dc2f1e4a4fd86509
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                MEYEYQUo.inf
                                                                • Path C:\ProgramData\YIwIwgoc\MEYEYQUo.inf
                                                                • Size 4B
                                                                • SHA256 763446e5d46a97d81d8c7f3d8c9bcea357f1d28d4b3dffef62fbe23ad9aae5b2
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                MEYEYQUo.inf
                                                                • Path C:\ProgramData\YIwIwgoc\MEYEYQUo.inf
                                                                • Size 4B
                                                                • SHA256 0987701db4295c2551ab5ec6360919d925ea9adb66c16f2e23c99d4516f18cc8
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                iqsE.txt
                                                                • Path C:\ProgramData\iqsE.txt
                                                                • Size 8KB
                                                                • SHA256 c56d839221d79822462865490e9d186577c218389049400db8fee8de12256848
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                TwEsUEEs.exe
                                                                • Path C:\ProgramData\woUkYoIA\TwEsUEEs.exe
                                                                • Size 1.6MB
                                                                • SHA256 7f3c33194c0ec079c1e2f0c02daf8af22dde71a37dbd5de6e9715177599019e3
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock
                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-06-30_1b07d82422f934faa7f77cadc041e84b_elex_virlock
                                                                • Size 43KB
                                                                • SHA256 609824cc9c4f6c26c529ea3eb6f112c1a7c74d5ed58e25b6f9d88dce5944626a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                file.vbs
                                                                • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                • Size 19B
                                                                • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                ykIIkgMw.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\ykIIkgMw.bat
                                                                • Size 112B
                                                                • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                lMYAkogU.exe
                                                                • Path C:\Users\Admin\GCMcEIkI\lMYAkogU.exe
                                                                • Size 1.6MB
                                                                • SHA256 360dd240930d9ebd955d37d8571a2cac7655c7d058f1fcac492cf6fdb4fc7ed7
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                lMYAkogU.inf
                                                                • Path C:\Users\Admin\GCMcEIkI\lMYAkogU.inf
                                                                • Size 4B
                                                                • SHA256 80fb1d4ebd4ac7a830d031678c2a120b822dec8debea56020eb5cc151f9d9cbe
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                lMYAkogU.inf
                                                                • Path C:\Users\Admin\GCMcEIkI\lMYAkogU.inf
                                                                • Size 4B
                                                                • SHA256 4b73fcfe70bc2900bbeb43b323ff47fcf0b0454fada4f424ef368ea273d7fe45
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                lMYAkogU.inf
                                                                • Path C:\Users\Admin\GCMcEIkI\lMYAkogU.inf
                                                                • Size 4B
                                                                • SHA256 2e17c67bd06c31b8aff5ecb97583e4e95b6177d1ffd0f50c5705ad66e1be2ffb
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                lMYAkogU.inf
                                                                • Path C:\Users\Admin\GCMcEIkI\lMYAkogU.inf
                                                                • Size 4B
                                                                • SHA256 93b5c9b40c7280b7253091e7aab834680c4b84ae5af4ce994410f5e422967789
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                AAkS.exe
                                                                • Path C:\Windows\SysWOW64\AAkS.exe
                                                                • Size 1.6MB
                                                                • SHA256 7d57bc45778d03517d7cc3e66efb0e90409da48e6f438f1c7a8b8c9bc2486e60
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                AEQQ.exe
                                                                • Path C:\Windows\SysWOW64\AEQQ.exe
                                                                • Size 1.7MB
                                                                • SHA256 9231ef3e65148adb79b6979fd189e2722de0ab149b3f03eee1cafbf0bf5b9219
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                AOEM.ico
                                                                • Path C:\Windows\SysWOW64\AOEM.ico
                                                                • Size 4KB
                                                                • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                AQAo.exe
                                                                • Path C:\Windows\SysWOW64\AQAo.exe
                                                                • Size 1.7MB
                                                                • SHA256 23cd9f4614b08c8e05c9bb8edaa3029dc1e43019e41b5a765dc98cfa5cdd5fc8
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                AUAC.exe
                                                                • Path C:\Windows\SysWOW64\AUAC.exe
                                                                • Size 2.2MB
                                                                • SHA256 82ac445792a928b8a03db63acfb0015cc5cf356f36aace9ba8c94937051f7245
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                AcEi.exe
                                                                • Path C:\Windows\SysWOW64\AcEi.exe
                                                                • Size 1.6MB
                                                                • SHA256 94360270e6effc27a390562d4efb3f94b7abe20ed77cb2eaf40279bdb2ca7d8a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                AcsS.exe
                                                                • Path C:\Windows\SysWOW64\AcsS.exe
                                                                • Size 1.9MB
                                                                • SHA256 f6104cd2420eded46371a02ca36c31a3554879301c0f7ae3a09fa4e625cb05ad
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Akwy.exe
                                                                • Path C:\Windows\SysWOW64\Akwy.exe
                                                                • Size 1.6MB
                                                                • SHA256 f3a8a1e90a2aeaa8a5528393a3b5d430d2c9788bc508c1749365fa08771ff2f8
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                CAIw.exe
                                                                • Path C:\Windows\SysWOW64\CAIw.exe
                                                                • Size 1.6MB
                                                                • SHA256 841f70200deb222bdaa681d814c71dff728d52211bda22f63dbf4dc609dc70db
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                CUII.exe
                                                                • Path C:\Windows\SysWOW64\CUII.exe
                                                                • Size 1.8MB
                                                                • SHA256 5bd23e8ac4bc6fb166784f4f0a9c40174343b306059d26f8ab934d3f227afa35
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                CUkm.exe
                                                                • Path C:\Windows\SysWOW64\CUkm.exe
                                                                • Size 3.2MB
                                                                • SHA256 94dc55d2806f092e74b706d7c5b8fc2ddfaab270e33ae355606fd38625b4aa70
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                CgYc.exe
                                                                • Path C:\Windows\SysWOW64\CgYc.exe
                                                                • Size 1.7MB
                                                                • SHA256 74bc2d77b80ad816d61f748a0c32e864edbad79ec409b8df0670b19643e3e89b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                CkAU.exe
                                                                • Path C:\Windows\SysWOW64\CkAU.exe
                                                                • Size 1.6MB
                                                                • SHA256 3e9c1f52ad29082c0b5dff152b04db854920fd311915206cab11c3e6b197506b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                EEIs.exe
                                                                • Path C:\Windows\SysWOW64\EEIs.exe
                                                                • Size 2.9MB
                                                                • SHA256 2348497702df2992a70cc50c0acf0e5f1190f96d5155c6d736265270b34488c3
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                EIQC.exe
                                                                • Path C:\Windows\SysWOW64\EIQC.exe
                                                                • Size 2.3MB
                                                                • SHA256 a1c77ba81626d261dc4b2fd92150994e0e71ce197db7372d54924d35227a2bcf
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                EMEQ.exe
                                                                • Path C:\Windows\SysWOW64\EMEQ.exe
                                                                • Size 1.6MB
                                                                • SHA256 616ea9727fccef2bbf2b2371f6bb50f92b0b3d8b3af9de1a418ec6ee37289ed9
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                EMMG.exe
                                                                • Path C:\Windows\SysWOW64\EMMG.exe
                                                                • Size 2.2MB
                                                                • SHA256 4988f8cfd3f85a36f5050e4a32bbc527093f986a7319170be7965374ca6fcdd2
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                EcAa.exe
                                                                • Path C:\Windows\SysWOW64\EcAa.exe
                                                                • Size 1.9MB
                                                                • SHA256 367f651790af05d5e6f5363ef919b5e2f032aa3c0b31ce1169efd4b80ee23636
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                EcgK.exe
                                                                • Path C:\Windows\SysWOW64\EcgK.exe
                                                                • Size 1.7MB
                                                                • SHA256 53e97e587391a071b1482f3840ed779f11c015210d43d60a168f707b5fb7dc62
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                EkwE.exe
                                                                • Path C:\Windows\SysWOW64\EkwE.exe
                                                                • Size 1.6MB
                                                                • SHA256 53c95003c9596d741394b3116ac8e37276e6e6674073d7b84a103856a5e0b2d6
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                EoMy.exe
                                                                • Path C:\Windows\SysWOW64\EoMy.exe
                                                                • Size 2.0MB
                                                                • SHA256 8c33ddf5349cf9337b828bf6882017fe4c07e38dab92a28983a98748f83bbc2c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                EoQY.exe
                                                                • Path C:\Windows\SysWOW64\EoQY.exe
                                                                • Size 1.7MB
                                                                • SHA256 3c121f79dc05198fcdf653e9d1eb355dd9aee8af5a96d92d90b445e80fb135a1
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                EwMy.exe
                                                                • Path C:\Windows\SysWOW64\EwMy.exe
                                                                • Size 2.0MB
                                                                • SHA256 7b99db4af1895c3e21a71d497503b0d269573a5aabeb78d7f9022268595f0edb
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                EwcI.exe
                                                                • Path C:\Windows\SysWOW64\EwcI.exe
                                                                • Size 1.7MB
                                                                • SHA256 1cab894dc301b116c823f88d591c3be90dd5a03672fdb8f73a6e984f425dd17b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                GAwM.exe
                                                                • Path C:\Windows\SysWOW64\GAwM.exe
                                                                • Size 1.9MB
                                                                • SHA256 bff807248552c04ef152fd5c68564ea09334142d1ac2a94f317f5a7a31ff7d6a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                GQoS.exe
                                                                • Path C:\Windows\SysWOW64\GQoS.exe
                                                                • Size 1.8MB
                                                                • SHA256 24c7b3e785d07ff59b24a9349e2bc451fe4523935ce23cfde04713924ff1de80
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                GUYu.exe
                                                                • Path C:\Windows\SysWOW64\GUYu.exe
                                                                • Size 1.9MB
                                                                • SHA256 b6b7740343c77f4cbb90c3764b17fd9bf827849395eac416dbd5919f2bfbb2bc
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                IAAQ.exe
                                                                • Path C:\Windows\SysWOW64\IAAQ.exe
                                                                • Size 2.2MB
                                                                • SHA256 b2499419a6b55438b8b22f3ec644f1a8b2991a3d3a2006dc065c55e84eb07118
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                IEsE.ico
                                                                • Path C:\Windows\SysWOW64\IEsE.ico
                                                                • Size 4KB
                                                                • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                IQEa.exe
                                                                • Path C:\Windows\SysWOW64\IQEa.exe
                                                                • Size 1.8MB
                                                                • SHA256 2365e0b0c22f519bf15dcdbe1f04f263b8f4fe9adf9eb1e41e4d7a385eef124f
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                IQsG.exe
                                                                • Path C:\Windows\SysWOW64\IQsG.exe
                                                                • Size 1.6MB
                                                                • SHA256 e93b2955c2dad540921119235ca25818198dbde5d8b13f0726cc245c5b115491
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                IUww.exe
                                                                • Path C:\Windows\SysWOW64\IUww.exe
                                                                • Size 1.8MB
                                                                • SHA256 874a8997b3dc73171faea50b17217dc38c6ed3031f163a748cabcd670cdc1cb0
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                IYIk.exe
                                                                • Path C:\Windows\SysWOW64\IYIk.exe
                                                                • Size 3.1MB
                                                                • SHA256 b64dbab4566ef788984b33fa1315c4f3272521b134feab99ff29bb76198d19bb
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                IcQS.exe
                                                                • Path C:\Windows\SysWOW64\IcQS.exe
                                                                • Size 1.9MB
                                                                • SHA256 8e4083db327685bcbb44c20280b976923924a008375c9378fe36e216c532d097
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Iwwy.exe
                                                                • Path C:\Windows\SysWOW64\Iwwy.exe
                                                                • Size 2.1MB
                                                                • SHA256 4b1ff2c383d89b063071e94d4c39461b545d0d9719f1234d9c60a09b2ea4e8e7
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                KUYY.exe
                                                                • Path C:\Windows\SysWOW64\KUYY.exe
                                                                • Size 1.6MB
                                                                • SHA256 f71a3b02404e12a661de3410c08dec637d080de79957fe897563dcde17440d02
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                KYkc.exe
                                                                • Path C:\Windows\SysWOW64\KYkc.exe
                                                                • Size 1.6MB
                                                                • SHA256 762cc32b18842516e8a3806af1b39f58148f8c595b12d24808ed024e53be60f3
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                KcEw.exe
                                                                • Path C:\Windows\SysWOW64\KcEw.exe
                                                                • Size 1.8MB
                                                                • SHA256 359972fb49949be68b3b64c87d1c83d788a2a2266d260289bd946107668ca114
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                MAgm.exe
                                                                • Path C:\Windows\SysWOW64\MAgm.exe
                                                                • Size 2.1MB
                                                                • SHA256 a137f6be73812e2e73f59155e4dfd22be6fe427fbc36429edd89ad791404add0
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                MIIK.exe
                                                                • Path C:\Windows\SysWOW64\MIIK.exe
                                                                • Size 1.7MB
                                                                • SHA256 5f287fa151facb3a2e07c9c1cd3c4b8edffea25244a3e170c93326e82d5d012b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                MQEI.exe
                                                                • Path C:\Windows\SysWOW64\MQEI.exe
                                                                • Size 1.6MB
                                                                • SHA256 ed5ab721abdfe933c6fade7610b538163902adfbff874f788dec8fb4fc3d6209
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                MUEM.exe
                                                                • Path C:\Windows\SysWOW64\MUEM.exe
                                                                • Size 3.1MB
                                                                • SHA256 315af374f2d72b1ce171e3135220dc9c855099b85fc75d0b1225e31826217046
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                MYYg.exe
                                                                • Path C:\Windows\SysWOW64\MYYg.exe
                                                                • Size 1.6MB
                                                                • SHA256 4a194c8dc1d2597d039cfc19bc3143494c3243fdab901a8aca42875ecb1451ea
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Mgok.exe
                                                                • Path C:\Windows\SysWOW64\Mgok.exe
                                                                • Size 1.6MB
                                                                • SHA256 d4b9cef48df1b44d298920703428c60c1407be2257dc6e089a50ec10df9e276d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                MkEe.exe
                                                                • Path C:\Windows\SysWOW64\MkEe.exe
                                                                • Size 1.7MB
                                                                • SHA256 b9a0b9d9e1f4c612538e7ec608e8c1156bfe956ac6a59d0689800f09a83cc81f
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                OIsI.exe
                                                                • Path C:\Windows\SysWOW64\OIsI.exe
                                                                • Size 1.9MB
                                                                • SHA256 c837c52cf9963cb43ee247f8e8ef8a2be3a0095219bb13d75e3691ca91145df0
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                OMUG.exe
                                                                • Path C:\Windows\SysWOW64\OMUG.exe
                                                                • Size 1.8MB
                                                                • SHA256 852d1bb9e99278d6706523108974b9eec2b3395d51f2f2281e69e8151d0ca4fd
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                OcEg.exe
                                                                • Path C:\Windows\SysWOW64\OcEg.exe
                                                                • Size 1.6MB
                                                                • SHA256 1b7c71675e3b827d1421f3baef16540b6559d076c07e58cce26fb7b50f95ac3e
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                OgEo.ico
                                                                • Path C:\Windows\SysWOW64\OgEo.ico
                                                                • Size 4KB
                                                                • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                OwEi.exe
                                                                • Path C:\Windows\SysWOW64\OwEi.exe
                                                                • Size 1.9MB
                                                                • SHA256 d9166118fd25af9710d4b7493ec57309edb841c15366be9038929ae635d841ec
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                QAgu.exe
                                                                • Path C:\Windows\SysWOW64\QAgu.exe
                                                                • Size 2.0MB
                                                                • SHA256 7c659eaf6012f0b161d21a577801c751200a1264df173e05aa7de82ee786272b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                QAog.exe
                                                                • Path C:\Windows\SysWOW64\QAog.exe
                                                                • Size 1.7MB
                                                                • SHA256 8a679010aa9938db39281cc489cabb4accf1148ce5c95174632e28b36b57de30
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                QEAc.exe
                                                                • Path C:\Windows\SysWOW64\QEAc.exe
                                                                • Size 1.7MB
                                                                • SHA256 ff3e7205bfe579b89fbc5cb664f6f02c7e952aa20765ccf5fd55167d37af5836
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                QEwY.exe
                                                                • Path C:\Windows\SysWOW64\QEwY.exe
                                                                • Size 1.6MB
                                                                • SHA256 98aa18889428bc2c54bcc4031233c28d7e804a78f7af42542032bf472c2b26ff
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                QQUY.exe
                                                                • Path C:\Windows\SysWOW64\QQUY.exe
                                                                • Size 1.6MB
                                                                • SHA256 72512268a8b58aed447da4c7b6a960907d391cf95b923c0bda1bda0a209cb507
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                QkcW.exe
                                                                • Path C:\Windows\SysWOW64\QkcW.exe
                                                                • Size 1.6MB
                                                                • SHA256 39e4d53cf8b6cbeea1fd3b0a5b8ee6c441be6abcc6c9d8f6fcf7eea8e50b4fb5
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                SAEQ.exe
                                                                • Path C:\Windows\SysWOW64\SAEQ.exe
                                                                • Size 1.6MB
                                                                • SHA256 eaf7bfef90d171e35ac84324dad08d8bac85732f8df736ad6efbbc7f70f60a0d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                SEww.exe
                                                                • Path C:\Windows\SysWOW64\SEww.exe
                                                                • Size 2.1MB
                                                                • SHA256 2cb4a6ece915460432e2972a55f3f3350da8f6ed8de4bed16587c45bfd1b5383
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ScMM.exe
                                                                • Path C:\Windows\SysWOW64\ScMM.exe
                                                                • Size 2.2MB
                                                                • SHA256 2ce555c078a44cb471789bc7add23f306414e0cd2aac3dd4081504e979be9799
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                SgcM.exe
                                                                • Path C:\Windows\SysWOW64\SgcM.exe
                                                                • Size 1.6MB
                                                                • SHA256 23e4f3536bb3a8b16c24d9266ccdb162efce4a240092a3b54af6c2706d205108
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                UAMm.exe
                                                                • Path C:\Windows\SysWOW64\UAMm.exe
                                                                • Size 1.8MB
                                                                • SHA256 43f604f0371d21c12078fee638523cb661e4ca02c8096281febdf4f8d88eaaf2
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                UAsq.exe
                                                                • Path C:\Windows\SysWOW64\UAsq.exe
                                                                • Size 2.5MB
                                                                • SHA256 fa24cc6fff9ca1dcfb3f21fe89fbeb6e4bbf774a07be79d8cd083f55ed062127
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                UEAo.ico
                                                                • Path C:\Windows\SysWOW64\UEAo.ico
                                                                • Size 4KB
                                                                • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                UEQm.exe
                                                                • Path C:\Windows\SysWOW64\UEQm.exe
                                                                • Size 2.4MB
                                                                • SHA256 234411ffa6449c9fabe9c25de20ce227e186af0ca5abad4501399fdbd1c619ba
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                UQky.exe
                                                                • Path C:\Windows\SysWOW64\UQky.exe
                                                                • Size 1.9MB
                                                                • SHA256 27fe047f9fdad08cdbf11f084dba2ea05a01088e2a8315f130425e026ec89ced
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                UgQk.ico
                                                                • Path C:\Windows\SysWOW64\UgQk.ico
                                                                • Size 4KB
                                                                • SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                UkwA.exe
                                                                • Path C:\Windows\SysWOW64\UkwA.exe
                                                                • Size 1.7MB
                                                                • SHA256 01e904e5f4416943c515de9be4a9a2de9a55ec6a0433a26e8954ea587fde4415
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                UwAA.exe
                                                                • Path C:\Windows\SysWOW64\UwAA.exe
                                                                • Size 2.1MB
                                                                • SHA256 5efcee4b8eee514b4b6e6e50bca74e1d0844f9666bef63277e7c628f0553177e
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                WEUi.exe
                                                                • Path C:\Windows\SysWOW64\WEUi.exe
                                                                • Size 1.8MB
                                                                • SHA256 7b074ab4e9e57f211d158e74f318045c66a41a2f84d1ad32449666931c35ab27
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                WIEM.exe
                                                                • Path C:\Windows\SysWOW64\WIEM.exe
                                                                • Size 2.0MB
                                                                • SHA256 6c9d2ba2e71665a9711aa500c486a6558a940b5d2f1a7b027515fb4f45ce2820
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                WIMK.exe
                                                                • Path C:\Windows\SysWOW64\WIMK.exe
                                                                • Size 2.2MB
                                                                • SHA256 8e41ffa2d6febe50bdfdd76749fd7c8fdf08bc3280c0f7c9154823ec8efd9136
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                WQEE.exe
                                                                • Path C:\Windows\SysWOW64\WQEE.exe
                                                                • Size 3.0MB
                                                                • SHA256 a760058650f90e29561dafc97c2169a098a11f02d1222127c936c5990ade3802
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Wcke.exe
                                                                • Path C:\Windows\SysWOW64\Wcke.exe
                                                                • Size 1.7MB
                                                                • SHA256 182ee8f46d0e18db32c5b5e654d18ba710fd31df0f3e5233b924f5f53dc8084d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Wgsc.exe
                                                                • Path C:\Windows\SysWOW64\Wgsc.exe
                                                                • Size 1.6MB
                                                                • SHA256 785d415d3fcd95b7bcad83920020e8eaf09fab952180c166eb677a789938e640
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                WoEq.exe
                                                                • Path C:\Windows\SysWOW64\WoEq.exe
                                                                • Size 1.7MB
                                                                • SHA256 c0892f632310837492399319a24bbebbf28def9f5e2e8b1ea709e6a492bfc63f
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                WoIM.ico
                                                                • Path C:\Windows\SysWOW64\WoIM.ico
                                                                • Size 4KB
                                                                • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                YEAq.exe
                                                                • Path C:\Windows\SysWOW64\YEAq.exe
                                                                • Size 1.8MB
                                                                • SHA256 605df29e663e43da66cb5953fb4b5a8a51de07e9d2377257aa1c10d1d31226da
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                YEIo.exe
                                                                • Path C:\Windows\SysWOW64\YEIo.exe
                                                                • Size 1.6MB
                                                                • SHA256 6028454cf6b34b2da140759858e156504503ff1ea05a7168b309b090d35ee802
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                YOQc.ico
                                                                • Path C:\Windows\SysWOW64\YOQc.ico
                                                                • Size 4KB
                                                                • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                YUEA.ico
                                                                • Path C:\Windows\SysWOW64\YUEA.ico
                                                                • Size 4KB
                                                                • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Ycwo.exe
                                                                • Path C:\Windows\SysWOW64\Ycwo.exe
                                                                • Size 1.6MB
                                                                • SHA256 867fd9afd195bb43cd019394621a525f774f82f6ee3d00f00a240cc12c82e586
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                YsYw.exe
                                                                • Path C:\Windows\SysWOW64\YsYw.exe
                                                                • Size 2.7MB
                                                                • SHA256 6dee641957f13f945000986e67b16bea93a681fbe6865e6d2926538489e47758
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Yssg.ico
                                                                • Path C:\Windows\SysWOW64\Yssg.ico
                                                                • Size 4KB
                                                                • SHA256 9a233711400b52fc399d16bb7e3937772c44d7841a24a685467e19dfa57769d5
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                aMws.exe
                                                                • Path C:\Windows\SysWOW64\aMws.exe
                                                                • Size 1.9MB
                                                                • SHA256 9ca85b1125feeb3c943a071523373c1e45124da17ac71d4de2e1a23941b403ed
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                acAg.exe
                                                                • Path C:\Windows\SysWOW64\acAg.exe
                                                                • Size 1.9MB
                                                                • SHA256 c6eb1b805eb0b70a736138576c9ebb3e0ec8c69a15c7be2b89e5e345e89637e2
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                akwS.exe
                                                                • Path C:\Windows\SysWOW64\akwS.exe
                                                                • Size 1.8MB
                                                                • SHA256 f8956964d3c1c946ea636b8d7ff68216c72efc867377bb8696bce63a9c79b895
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                asUG.exe
                                                                • Path C:\Windows\SysWOW64\asUG.exe
                                                                • Size 1.9MB
                                                                • SHA256 7fd90b4e6dceeb24afec98a20d7e3baa3b7408fdd909cc5480a03d8f7dece240
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                asUg.exe
                                                                • Path C:\Windows\SysWOW64\asUg.exe
                                                                • Size 1.9MB
                                                                • SHA256 e22164c458f20adb556eef4ff751d5629ef982fd413f1dce4ca53051844c0871
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                cIUo.exe
                                                                • Path C:\Windows\SysWOW64\cIUo.exe
                                                                • Size 1.6MB
                                                                • SHA256 2d2970e9756ddf0eb4ba8d97ac1cbee655412cb8f6548a0bed1a893e727ce2fa
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                cMUC.exe
                                                                • Path C:\Windows\SysWOW64\cMUC.exe
                                                                • Size 2.2MB
                                                                • SHA256 5940137ad88b5b11a0759bc3b6388f4aff8d4916c8de030792ade49dcbbe4c1c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                cMcU.exe
                                                                • Path C:\Windows\SysWOW64\cMcU.exe
                                                                • Size 1.6MB
                                                                • SHA256 fd2a86e7f44989a266b5885e998f2717ed1c37ad842c5d524ab869436790e8f5
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                cUwO.exe
                                                                • Path C:\Windows\SysWOW64\cUwO.exe
                                                                • Size 1.7MB
                                                                • SHA256 1b56ec6eb7320e7940bd65bde9d33d7519fedc01ab8f0c7e4ee500eb1077cc8f
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ckAc.exe
                                                                • Path C:\Windows\SysWOW64\ckAc.exe
                                                                • Size 1.9MB
                                                                • SHA256 2b2d69b546a955732957714f1b88a1b6dcddcb836c4e41966032b60bf547746d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ckUy.exe
                                                                • Path C:\Windows\SysWOW64\ckUy.exe
                                                                • Size 2.0MB
                                                                • SHA256 e0db1b8eab9f930dbb00dd4ec03888ce94e0efd3712c5d95044875d6f33b743a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                coEm.exe
                                                                • Path C:\Windows\SysWOW64\coEm.exe
                                                                • Size 1.6MB
                                                                • SHA256 ca1acfda787d3b00950fe7d8621ed95a7da192880c6dd43a9ee8b3ae23c79876
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eIgc.exe
                                                                • Path C:\Windows\SysWOW64\eIgc.exe
                                                                • Size 1.7MB
                                                                • SHA256 2962bad5be7ddf94e907d4e6821692e032d6e83bd0f22cdd87d16b2063879f78
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eIgc.exe
                                                                • Path C:\Windows\SysWOW64\eIgc.exe
                                                                • Size 1.6MB
                                                                • SHA256 8fcc22dc32d4503f34878ebfbc7b7e325d8a6b8963d120cf7369f312f3f6b90a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eMQQ.exe
                                                                • Path C:\Windows\SysWOW64\eMQQ.exe
                                                                • Size 1.8MB
                                                                • SHA256 29eecbc4b102d3afd58af1d4d1ae08d3415949ce4e10bca5f4c428c61e207a52
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eYEy.exe
                                                                • Path C:\Windows\SysWOW64\eYEy.exe
                                                                • Size 1.9MB
                                                                • SHA256 20523a4f6b97fc67c3dab8335ecec135b0488b5eb749000112b8576519cf396a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eckQ.exe
                                                                • Path C:\Windows\SysWOW64\eckQ.exe
                                                                • Size 1.6MB
                                                                • SHA256 b2929bc5011028c53661458e9a0ad883dbb8fabc701f35e50f399bbd25cdef3f
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eoUi.exe
                                                                • Path C:\Windows\SysWOW64\eoUi.exe
                                                                • Size 1.9MB
                                                                • SHA256 25c58a8b91889776ba10ad79d6155a154dcc44633b51319ce95d6534a6c04ecf
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eoYy.exe
                                                                • Path C:\Windows\SysWOW64\eoYy.exe
                                                                • Size 1.8MB
                                                                • SHA256 0b44e5788a18eba8f8dad16ae646c951708d298095ac8771621d7ef1f1f6cb93
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eowY.exe
                                                                • Path C:\Windows\SysWOW64\eowY.exe
                                                                • Size 2.0MB
                                                                • SHA256 bbc1e0f6f5709c24ca326db4b486345dce238158ca0dc0472fd8180057e0dd32
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                gEgq.exe
                                                                • Path C:\Windows\SysWOW64\gEgq.exe
                                                                • Size 2.2MB
                                                                • SHA256 606fb3a2ed3e82ee71bc07677f738fa7458d25879d01ac41df06dfe87013e695
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                gMca.exe
                                                                • Path C:\Windows\SysWOW64\gMca.exe
                                                                • Size 1.8MB
                                                                • SHA256 041c7965f7dff9e77ef1987c22799bd181ebb45944007f3ee163d0693ebb0ba8
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                gUQo.exe
                                                                • Path C:\Windows\SysWOW64\gUQo.exe
                                                                • Size 2.4MB
                                                                • SHA256 530841571c94c671857f9f281ab1f851e0bdf0cd295e196d94ac2e4855ae7c77
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ggse.exe
                                                                • Path C:\Windows\SysWOW64\ggse.exe
                                                                • Size 1.9MB
                                                                • SHA256 71641b986b763d92a9f0fa859a134a1224a2081d897c002588935249b0525985
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                gsMw.exe
                                                                • Path C:\Windows\SysWOW64\gsMw.exe
                                                                • Size 2.0MB
                                                                • SHA256 3eb4f5b603df4695767b36d1711774ceff131e5bf5bd4fa36dd9cba7e56b406e
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                iAsg.exe
                                                                • Path C:\Windows\SysWOW64\iAsg.exe
                                                                • Size 2.0MB
                                                                • SHA256 941b815a149f51a1d284fc0f44891c982489ac6192384d458cfe54eca17d7a6b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ickg.exe
                                                                • Path C:\Windows\SysWOW64\ickg.exe
                                                                • Size 1.6MB
                                                                • SHA256 5e4246c84f9d59f508a1a47396b0a8026a39727f64f1fac2ed90695d3058f6e9
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                isMc.ico
                                                                • Path C:\Windows\SysWOW64\isMc.ico
                                                                • Size 4KB
                                                                • SHA256 e1131246c60ad423586203bb8b9287e365051101ddbf532132bd47ef03ab86c8
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                isQm.exe
                                                                • Path C:\Windows\SysWOW64\isQm.exe
                                                                • Size 2.0MB
                                                                • SHA256 983795e63db9a1ab98fe1bf95d0e4f39effb244be6fd31a6015fda26a59cc3eb
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                isoE.exe
                                                                • Path C:\Windows\SysWOW64\isoE.exe
                                                                • Size 1.8MB
                                                                • SHA256 1178ae71877e1aa29ace55dcb246aa1c293f17fdc91b5698ad48fe57b052de4b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                kAII.exe
                                                                • Path C:\Windows\SysWOW64\kAII.exe
                                                                • Size 1.6MB
                                                                • SHA256 ef4fa5c99877e25ad5ea849b2183ff0fbd3a8d26591fcea7139fa7e7dbfd9b76
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                kMQS.exe
                                                                • Path C:\Windows\SysWOW64\kMQS.exe
                                                                • Size 2.2MB
                                                                • SHA256 51d7812d5a55fd1d1faf1121adef218fdd00929bfef9debb141b91ca690bbbd5
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                kccg.exe
                                                                • Path C:\Windows\SysWOW64\kccg.exe
                                                                • Size 2.3MB
                                                                • SHA256 1a55787b196ce90b1adb015ba09441a824805d1da5eaefdd83e78e2f6c864c53
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                mAMK.exe
                                                                • Path C:\Windows\SysWOW64\mAMK.exe
                                                                • Size 1.6MB
                                                                • SHA256 f020c87244b8247cf147c77157ca8218af1ff9d2f596b432f878e03f4ac6f7c1
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                mIss.exe
                                                                • Path C:\Windows\SysWOW64\mIss.exe
                                                                • Size 2.0MB
                                                                • SHA256 0eade0b0cde2a372c94bb1e1167b479dcbbf6c4903573771db2b550da689b196
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                mMEe.exe
                                                                • Path C:\Windows\SysWOW64\mMEe.exe
                                                                • Size 2.0MB
                                                                • SHA256 0428e80f497978f0d7902fda1d021cda64ca68bb9288086e74d7dfe8bf3b8735
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                mQUu.exe
                                                                • Path C:\Windows\SysWOW64\mQUu.exe
                                                                • Size 1.6MB
                                                                • SHA256 f5ce0fe029b38b40c2d765e7acfcef275fac61b158eaede4733a00f0341ac753
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                mgMs.ico
                                                                • Path C:\Windows\SysWOW64\mgMs.ico
                                                                • Size 4KB
                                                                • SHA256 114dae4c54ca426f78e50998727dac92942261d71ca5b2dbaf413794dcf8ad82
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                mkIE.exe
                                                                • Path C:\Windows\SysWOW64\mkIE.exe
                                                                • Size 2.3MB
                                                                • SHA256 c3c6ee31c6deb2b0443ea6fda956b40066cd8becbd1d076f7235537732cbd5cb
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                oggA.exe
                                                                • Path C:\Windows\SysWOW64\oggA.exe
                                                                • Size 1.6MB
                                                                • SHA256 3a1f6055f8cfafdff9c0fe22bf3d04a00abcfe75ec63c31c3d295caa67866154
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                oqYE.ico
                                                                • Path C:\Windows\SysWOW64\oqYE.ico
                                                                • Size 4KB
                                                                • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                osss.exe
                                                                • Path C:\Windows\SysWOW64\osss.exe
                                                                • Size 1.6MB
                                                                • SHA256 725cdaf96a329fdb288404f343806167a74a77b1ce3f3998ec64d9865c65c9dd
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                qIES.exe
                                                                • Path C:\Windows\SysWOW64\qIES.exe
                                                                • Size 1.6MB
                                                                • SHA256 7bd73d0dc6ec4785ff6c5c28c5da51b701cd2af23d68f16022133017e0a6e957
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                qUYo.exe
                                                                • Path C:\Windows\SysWOW64\qUYo.exe
                                                                • Size 1.7MB
                                                                • SHA256 014e0b2dd7f56b7b8a8a91922ecc31f3d80fbd365df91a05a88ce7e9beebd9f4
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                qWUo.ico
                                                                • Path C:\Windows\SysWOW64\qWUo.ico
                                                                • Size 4KB
                                                                • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                sAQO.exe
                                                                • Path C:\Windows\SysWOW64\sAQO.exe
                                                                • Size 1.8MB
                                                                • SHA256 029e9488b649aa912984d04435fe333e74c7fbca8938d6a2cb81e65da0e3f659
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                skQY.exe
                                                                • Path C:\Windows\SysWOW64\skQY.exe
                                                                • Size 1.9MB
                                                                • SHA256 0b9bec418f110606304aad0232d1ebed9736762191b4dac04a42fdacd6c86286
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                uIwi.exe
                                                                • Path C:\Windows\SysWOW64\uIwi.exe
                                                                • Size 1.6MB
                                                                • SHA256 6dec1ecff0271851643be4fcd27bde215ce988b4c358f66ed84df3fbe21da45b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                uMIY.exe
                                                                • Path C:\Windows\SysWOW64\uMIY.exe
                                                                • Size 1.8MB
                                                                • SHA256 caed54a5c46c53b1faac702349a9bf99120ca001a5deb7c31c66d9b5ea2e8751
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                uQAA.exe
                                                                • Path C:\Windows\SysWOW64\uQAA.exe
                                                                • Size 1.6MB
                                                                • SHA256 920641b7977390b081abb6b57f1521d3bb7a1d2e3bd1f606c1d80906852844fb
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                uYoG.exe
                                                                • Path C:\Windows\SysWOW64\uYoG.exe
                                                                • Size 1.6MB
                                                                • SHA256 4ea4ec359d0ba2815a00773b7675693dc7cda37b16a86368f95fc3b1a3ad8898
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ugEG.exe
                                                                • Path C:\Windows\SysWOW64\ugEG.exe
                                                                • Size 2.0MB
                                                                • SHA256 68ddcb560ab11cd3a204d0c1e860b7afbce9f3ac427949cd59432b69b206939b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                uggE.exe
                                                                • Path C:\Windows\SysWOW64\uggE.exe
                                                                • Size 1.7MB
                                                                • SHA256 68a02a953d3196169b593796d9f072016f423cdfa8b33a0daf1e2fade9b034c7
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ukMo.exe
                                                                • Path C:\Windows\SysWOW64\ukMo.exe
                                                                • Size 2.4MB
                                                                • SHA256 784a9548c75c489462d3971746de1769ad5b6537ff0396f9d794ca9cb2963ff4
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                uwMg.exe
                                                                • Path C:\Windows\SysWOW64\uwMg.exe
                                                                • Size 1.6MB
                                                                • SHA256 e2aee97eb734859108b61efc7ed1c50a1034033b18788ad4ecd4febe56f8da2f
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                wQEG.exe
                                                                • Path C:\Windows\SysWOW64\wQEG.exe
                                                                • Size 1.7MB
                                                                • SHA256 935f15ca4c0a4dd73733a5c76ba97acb464828615d5bd57eeb2edf92dc9a47d0
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                wUEK.exe
                                                                • Path C:\Windows\SysWOW64\wUEK.exe
                                                                • Size 1.8MB
                                                                • SHA256 41043a69802bae1060a38fcb5c3557342a705438e95d19513f7d839d58c1f089
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                wYkK.exe
                                                                • Path C:\Windows\SysWOW64\wYkK.exe
                                                                • Size 1.6MB
                                                                • SHA256 28505e4b9b9c0337ac06bc9bb773758ee1fe095f0468d8ee999500d4a6c8477b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                wgMS.exe
                                                                • Path C:\Windows\SysWOW64\wgMS.exe
                                                                • Size 1.6MB
                                                                • SHA256 e8b2f68eacab13ddea1277ba6224e4812013cb76218943ae26662fbf4970cfbb
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                wgoE.exe
                                                                • Path C:\Windows\SysWOW64\wgoE.exe
                                                                • Size 2.1MB
                                                                • SHA256 73dbdaa6965d5fde5a123d3c952fa15cbb7db258737cce298f8d2d7c17327ca1
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                wkkE.exe
                                                                • Path C:\Windows\SysWOW64\wkkE.exe
                                                                • Size 2.2MB
                                                                • SHA256 fdaa24f68f7baba03c07c52f39249bfec5aaa6901a5dfa3af69272668be717eb
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                wkwe.exe
                                                                • Path C:\Windows\SysWOW64\wkwe.exe
                                                                • Size 2.0MB
                                                                • SHA256 53bc1eb8f64752570bc465b6fbf665979657425a9cf5a59dc9cac7ff0f150cd2
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                wosA.exe
                                                                • Path C:\Windows\SysWOW64\wosA.exe
                                                                • Size 2.3MB
                                                                • SHA256 7570347de9979d1d1e68facf251c8709158bb89694c6c45e8536c9772433ebf7
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                wsQu.exe
                                                                • Path C:\Windows\SysWOW64\wsQu.exe
                                                                • Size 1.7MB
                                                                • SHA256 b5df4eb2947faef3259aa6952264f696d565af1f4fa52318e3be0431b65263bf
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                yUIE.exe
                                                                • Path C:\Windows\SysWOW64\yUIE.exe
                                                                • Size 1.8MB
                                                                • SHA256 ceb46fda9b88a37a9c8686209b996e90038ec52c5eafab4830ef469b10c54d56
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ykYW.exe
                                                                • Path C:\Windows\SysWOW64\ykYW.exe
                                                                • Size 1.6MB
                                                                • SHA256 dbc64dc14a5348e6fee41cf522d46e3e0ae9a90551c1328cad3b96a91fd96413
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                yooa.exe
                                                                • Path C:\Windows\SysWOW64\yooa.exe
                                                                • Size 2.2MB
                                                                • SHA256 3c2704717cfcc3fb0ed2d67149f86ea496a7c907841722d4fbb8942759043adf
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ysIy.exe
                                                                • Path C:\Windows\SysWOW64\ysIy.exe
                                                                • Size 2.3MB
                                                                • SHA256 4929f22a72e2f801484adb3fa20be2bb750715f1d1873868526e0f039c326cf3
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                yskw.exe
                                                                • Path C:\Windows\SysWOW64\yskw.exe
                                                                • Size 1.9MB
                                                                • SHA256 d28dd80ffd7f3a65a6264c41ccc957060388def035745e01d3ade374c2691d54
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                memory/1244-2104-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                Download

                                                                memory/1752-83-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                Download

                                                                memory/2288-127-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                Download

                                                                memory/2532-803-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                Download

                                                                memory/2608-0-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                Download

                                                                memory/2608-31-0x0000000002340000-0x0000000002360000-memory.dmp
                                                                Download

                                                                memory/2608-30-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                Download

                                                                memory/2608-1-0x0000000002340000-0x0000000002360000-memory.dmp
                                                                Download

                                                                memory/2680-415-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                Download

                                                                memory/2680-364-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                Download

                                                                memory/2956-158-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                Download

                                                                memory/2992-507-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                Download

                                                                memory/3312-113-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                Download

                                                                memory/3856-601-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                Download

                                                                memory/3932-217-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                Download

                                                                memory/4268-174-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                Download

                                                                memory/4644-136-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                Download

                                                                memory/4644-153-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                Download

                                                                memory/4704-192-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                Download

                                                                memory/4936-148-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                Download

                                                                memory/4936-150-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                Download

                                                                memory/4952-133-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                Download

                                                                memory/4952-154-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                Download

                                                                memory/5056-50-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                Download

                                                                memory/5200-152-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                Download

                                                                memory/5200-137-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                Download

                                                                memory/5224-2109-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                Download

                                                                memory/5424-281-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                Download

                                                                memory/5436-708-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                Download

                                                                memory/5440-157-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                Download

                                                                memory/5456-94-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                Download

                                                                memory/5664-14-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                Download

                                                                memory/5664-2090-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                Download

                                                                memory/5800-2095-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                Download

                                                                memory/5800-19-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                Download

                                                                memory/6088-62-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                Download

                                                                memory/6104-7-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                Download

                                                                memory/6104-2085-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                Download