Overview

overview

10

Static

static

3

2026-07-03...ck.exe

windows10-2004-x64

10

2026-07-03...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    96s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/07/2026, 03:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
  • Size 2.1MB
  • Sample260703-dvpr9aaz2y
  • SHA256 85d4df50c388dfa6923edecb88d2ad583175f792aa146c1f8ae6df0e50436876
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoverynabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 36 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 36 IoCs
    defense_evasiontrojan
  • Renames multiple (99) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 63 IoCs
  • Suspicious use of SendNotifyMessage 46 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2996
    • C:\Users\Admin\HmEsAIwQ\dmMMsscM.exe
      "C:\Users\Admin\HmEsAIwQ\dmMMsscM.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:3412
    • C:\ProgramData\OwsUckMc\PkowgcAc.exe
      "C:\ProgramData\OwsUckMc\PkowgcAc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:5352
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4872
      • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1076
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3920
          • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:252
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3056
              • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3224
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4860
                  • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:756
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:1744
                      • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:5700
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:3344
                          • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                            13⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:5556
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4472
                              • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:696
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2132
                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                    17⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:1732
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                      18⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:3620
                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                        19⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4704
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                          20⤵
                                            PID:1536
                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                              C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                              21⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:1804
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                22⤵
                                                  PID:1216
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                    23⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4740
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                      24⤵
                                                        PID:5780
                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                          25⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:1616
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                            26⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:3484
                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                              27⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:3512
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                                28⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:984
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                                  29⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:1144
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                                    30⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:5388
                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                                      31⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:1044
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                                        32⤵
                                                                          PID:4772
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                                            33⤵
                                                                              PID:596
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                                                34⤵
                                                                                  PID:3300
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                                                    35⤵
                                                                                      PID:3268
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                                                        36⤵
                                                                                          PID:2608
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                                                            37⤵
                                                                                              PID:2880
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                                                                38⤵
                                                                                                  PID:5420
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                                                                    39⤵
                                                                                                      PID:2436
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                                                                        40⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:2664
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                                                                          41⤵
                                                                                                            PID:5192
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                                                                              42⤵
                                                                                                                PID:5392
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                                                                                  43⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:5260
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                                                                                    44⤵
                                                                                                                      PID:3252
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                                                                                        45⤵
                                                                                                                          PID:5772
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                                                                                            46⤵
                                                                                                                              PID:2444
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                                                                                                47⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:5000
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                                                                                                  48⤵
                                                                                                                                    PID:4588
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                                                                                                      49⤵
                                                                                                                                        PID:6120
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                                                                                                          50⤵
                                                                                                                                            PID:124
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                                                                                                              51⤵
                                                                                                                                                PID:2836
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                                                                                                                  52⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:4300
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                                                                                                                    53⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:6084
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                                                                                                                      54⤵
                                                                                                                                                        PID:5040
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                                                                                                                          55⤵
                                                                                                                                                            PID:2896
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                                                                                                                              56⤵
                                                                                                                                                                PID:5372
                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  57⤵
                                                                                                                                                                    PID:432
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                                                                                                                                    57⤵
                                                                                                                                                                      PID:2016
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                                                                                                                                        58⤵
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:5944
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                                                                                                                                          59⤵
                                                                                                                                                                            PID:2080
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                                                                                                                                              60⤵
                                                                                                                                                                                PID:1048
                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                  61⤵
                                                                                                                                                                                    PID:1860
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                                                                                                                                                    61⤵
                                                                                                                                                                                      PID:1492
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                                                                                                                                                        62⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:5112
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                                                                                                                                                          63⤵
                                                                                                                                                                                            PID:5596
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                                                                                                                                                              64⤵
                                                                                                                                                                                                PID:4304
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                                                                                                                                                                  65⤵
                                                                                                                                                                                                    PID:2336
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                                                                                                                                                                      66⤵
                                                                                                                                                                                                        PID:3696
                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                          67⤵
                                                                                                                                                                                                            PID:1140
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                                                                                                                                                                            67⤵
                                                                                                                                                                                                              PID:2704
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                                                                                                                                                                                68⤵
                                                                                                                                                                                                                  PID:4292
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                                                                                                                                                                                    69⤵
                                                                                                                                                                                                                      PID:1644
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                                                                                                                                                                                        70⤵
                                                                                                                                                                                                                          PID:2768
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                                                                                                                                                                                            71⤵
                                                                                                                                                                                                                              PID:2800
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock"
                                                                                                                                                                                                                                72⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:2152
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                72⤵
                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                PID:5940
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                72⤵
                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                PID:3152
                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                  73⤵
                                                                                                                                                                                                                                    PID:3312
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                  72⤵
                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                  PID:3560
                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                    73⤵
                                                                                                                                                                                                                                      PID:944
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TQUQQIgg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                    72⤵
                                                                                                                                                                                                                                      PID:3260
                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        73⤵
                                                                                                                                                                                                                                          PID:3632
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                          73⤵
                                                                                                                                                                                                                                            PID:5788
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                      PID:2924
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:1840
                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        71⤵
                                                                                                                                                                                                                                          PID:3220
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                        70⤵
                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                        PID:4600
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NMksYMsY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                        70⤵
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:5476
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                          71⤵
                                                                                                                                                                                                                                            PID:3784
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                      68⤵
                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                      PID:5156
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                      68⤵
                                                                                                                                                                                                                                        PID:1232
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                        68⤵
                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                        PID:1092
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XcwQoggM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                        68⤵
                                                                                                                                                                                                                                          PID:5036
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                            69⤵
                                                                                                                                                                                                                                              PID:2076
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                        66⤵
                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                        PID:940
                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                          67⤵
                                                                                                                                                                                                                                            PID:3128
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                          66⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                          PID:3452
                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            67⤵
                                                                                                                                                                                                                                              PID:3112
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                            PID:3144
                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                              67⤵
                                                                                                                                                                                                                                                PID:1704
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cwksYcsY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                              66⤵
                                                                                                                                                                                                                                                PID:2488
                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                  67⤵
                                                                                                                                                                                                                                                    PID:3016
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                    67⤵
                                                                                                                                                                                                                                                      PID:2552
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                64⤵
                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                PID:4404
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                64⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                PID:5344
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                64⤵
                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                PID:3564
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eWMkEUEQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                64⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:3060
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                  65⤵
                                                                                                                                                                                                                                                    PID:2628
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                              PID:2328
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                                                PID:4400
                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                  63⤵
                                                                                                                                                                                                                                                    PID:6040
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                  62⤵
                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                  PID:3136
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIwsYsIM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                  62⤵
                                                                                                                                                                                                                                                    PID:5180
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                      63⤵
                                                                                                                                                                                                                                                        PID:2792
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                  60⤵
                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                  PID:2860
                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                    61⤵
                                                                                                                                                                                                                                                      PID:3440
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:4544
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:1832
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vmgAswgk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                      PID:3536
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                        61⤵
                                                                                                                                                                                                                                                          PID:5816
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                    58⤵
                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:1112
                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                      59⤵
                                                                                                                                                                                                                                                        PID:1416
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                      58⤵
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:3488
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                      58⤵
                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                      PID:6024
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\emwQkQIE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                      58⤵
                                                                                                                                                                                                                                                        PID:5976
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                          59⤵
                                                                                                                                                                                                                                                            PID:5036
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                      56⤵
                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:3140
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                      56⤵
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:3928
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                      56⤵
                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:1416
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bugsgcAI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                      56⤵
                                                                                                                                                                                                                                                        PID:4340
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                          57⤵
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:3112
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                    54⤵
                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                    PID:3312
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                    54⤵
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:3008
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                    54⤵
                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:3160
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DCoggMgY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                    54⤵
                                                                                                                                                                                                                                                      PID:1296
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                        55⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:1696
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                  PID:3440
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                  PID:2192
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:1704
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KCkoMssA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:1396
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                    53⤵
                                                                                                                                                                                                                                                      PID:5592
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                50⤵
                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                PID:5028
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                50⤵
                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                PID:5344
                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                  51⤵
                                                                                                                                                                                                                                                    PID:2872
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                  50⤵
                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                  PID:2196
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wOcQcYYw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                  50⤵
                                                                                                                                                                                                                                                    PID:4484
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                      51⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:2420
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                48⤵
                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                PID:2504
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                48⤵
                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                PID:3436
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                48⤵
                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                PID:1696
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dmYoIMQM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                48⤵
                                                                                                                                                                                                                                                  PID:6116
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                    49⤵
                                                                                                                                                                                                                                                      PID:2792
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                46⤵
                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                PID:1112
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                46⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:2780
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                46⤵
                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                PID:6024
                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                  47⤵
                                                                                                                                                                                                                                                    PID:5744
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fewQAsww.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                  46⤵
                                                                                                                                                                                                                                                    PID:3752
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                      47⤵
                                                                                                                                                                                                                                                        PID:5712
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                  44⤵
                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                  PID:4404
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                  44⤵
                                                                                                                                                                                                                                                    PID:2768
                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                      45⤵
                                                                                                                                                                                                                                                        PID:2532
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                      44⤵
                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:2552
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SeswEYAg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                      44⤵
                                                                                                                                                                                                                                                        PID:1292
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                          45⤵
                                                                                                                                                                                                                                                            PID:5400
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                      42⤵
                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:4336
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                      42⤵
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:5472
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                      42⤵
                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:2556
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zYAUIUIU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                      42⤵
                                                                                                                                                                                                                                                        PID:2968
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                          43⤵
                                                                                                                                                                                                                                                            PID:124
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                      40⤵
                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:4484
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                      40⤵
                                                                                                                                                                                                                                                        PID:5756
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                        40⤵
                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:3016
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TkUAIsMo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                        40⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:2464
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                          41⤵
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:2500
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                    38⤵
                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:4868
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                    38⤵
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:3628
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                    38⤵
                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                    PID:2832
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vsIcAwQI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                    38⤵
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:3132
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                      39⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:1860
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                PID:4304
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                PID:3396
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                PID:6100
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\boMcYQQc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                                                  PID:1828
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                    37⤵
                                                                                                                                                                                                                                                      PID:3632
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                34⤵
                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                PID:5580
                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                  35⤵
                                                                                                                                                                                                                                                    PID:1812
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                  34⤵
                                                                                                                                                                                                                                                    PID:3428
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                    34⤵
                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                    PID:3564
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uecEwkcE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                    34⤵
                                                                                                                                                                                                                                                      PID:352
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                        35⤵
                                                                                                                                                                                                                                                          PID:4288
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:5164
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:4820
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:4556
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WYIEUAIs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                                                                      PID:5512
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                        33⤵
                                                                                                                                                                                                                                                          PID:5372
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                    30⤵
                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:4344
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                    30⤵
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:1620
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                    30⤵
                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                    PID:2804
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UIIgggwQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                    30⤵
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:3380
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                      31⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:1508
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                28⤵
                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                PID:2080
                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                  29⤵
                                                                                                                                                                                                                                                    PID:4904
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                  28⤵
                                                                                                                                                                                                                                                    PID:1624
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                    28⤵
                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                    PID:2936
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\huUoAkAM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                    28⤵
                                                                                                                                                                                                                                                      PID:2848
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                        29⤵
                                                                                                                                                                                                                                                          PID:3128
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                    26⤵
                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:5688
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                    26⤵
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:5000
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                    26⤵
                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:944
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FcgYccgM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                    26⤵
                                                                                                                                                                                                                                                      PID:2508
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                        27⤵
                                                                                                                                                                                                                                                          PID:2860
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                    24⤵
                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:1768
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                    24⤵
                                                                                                                                                                                                                                                      PID:3528
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                      24⤵
                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                      PID:3312
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HyUAgwcU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                      24⤵
                                                                                                                                                                                                                                                        PID:5840
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                          25⤵
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:1156
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                    22⤵
                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:1828
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                    22⤵
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:5824
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                    22⤵
                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:2420
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GYYosAUk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                    22⤵
                                                                                                                                                                                                                                                      PID:2888
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                        23⤵
                                                                                                                                                                                                                                                          PID:432
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                    20⤵
                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                    PID:5112
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                    20⤵
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:6040
                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                      21⤵
                                                                                                                                                                                                                                                        PID:4848
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:1140
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IuAUUgYQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                                                                        PID:2380
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                          21⤵
                                                                                                                                                                                                                                                            PID:5212
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                      18⤵
                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                      PID:3220
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                      18⤵
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:3308
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                      18⤵
                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:2532
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qSgwQAME.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                      18⤵
                                                                                                                                                                                                                                                        PID:2788
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                          19⤵
                                                                                                                                                                                                                                                            PID:1656
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:3380
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:5712
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:2484
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bUAkkYUk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                      PID:3240
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                        17⤵
                                                                                                                                                                                                                                                          PID:5384
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:2872
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:4904
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                    PID:2640
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fWMkgQIk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                    PID:1876
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                                                                        PID:1704
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                  PID:476
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                  PID:2040
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                  PID:4588
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zUkssIUY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                  PID:1864
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:628
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                              PID:3136
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                              PID:5744
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                              PID:2980
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\giAEkIUQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                              PID:5012
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:1956
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                          PID:4304
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                            PID:2888
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                            PID:3992
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yGsAEgkM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                            PID:4504
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                PID:4956
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                          PID:1536
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                            PID:4848
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                            PID:1804
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qogUEwUw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                            PID:1064
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                PID:1812
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                          PID:2788
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:4948
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                            PID:3308
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PqgcwcEU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                            PID:2104
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                PID:260
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                          PID:5384
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:5592
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                            PID:3976
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VwMsMkMM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock.exe""
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                            PID:1608
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:5516
                                                                                                                                                                                                                                        • C:\ProgramData\dgIIscsE\wKcYwIgM.exe
                                                                                                                                                                                                                                          C:\ProgramData\dgIIscsE\wKcYwIgM.exe
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                          PID:1224
                                                                                                                                                                                                                                        • C:\Users\Admin\HmEsAIwQ\dmMMsscM.exe
                                                                                                                                                                                                                                          C:\Users\Admin\HmEsAIwQ\dmMMsscM.exe
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                          PID:3736
                                                                                                                                                                                                                                        • C:\ProgramData\OwsUckMc\PkowgcAc.exe
                                                                                                                                                                                                                                          C:\ProgramData\OwsUckMc\PkowgcAc.exe
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                          PID:4732
                                                                                                                                                                                                                                        • C:\Windows\system32\sihost.exe
                                                                                                                                                                                                                                          sihost.exe
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                          PID:5016
                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                            explorer.exe /LOADSAVEDWINDOWS
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                            PID:5776
                                                                                                                                                                                                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                                                                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                          PID:1508
                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                          PID:3348

                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                              Reconnaissance

                                                                                                                                                                                                                                              Resource Development

                                                                                                                                                                                                                                              Initial Access

                                                                                                                                                                                                                                              Execution

                                                                                                                                                                                                                                              Persistence

                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                              Active Setup

                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                              T1547.014

                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                                                                                              Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                              T1548

                                                                                                                                                                                                                                              Bypass User Account Control

                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                              T1548.002

                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                              Active Setup

                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                              T1547.014

                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                              Defense Evasion

                                                                                                                                                                                                                                              Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                              T1548

                                                                                                                                                                                                                                              Bypass User Account Control

                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                              T1548.002

                                                                                                                                                                                                                                              Hide Artifacts

                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                              T1564

                                                                                                                                                                                                                                              Hidden Files and Directories

                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                              T1564.001

                                                                                                                                                                                                                                              Impair Defenses

                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                              T1562

                                                                                                                                                                                                                                              Disable or Modify Tools

                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                              T1562.001

                                                                                                                                                                                                                                              Modify Registry

                                                                                                                                                                                                                                              6
                                                                                                                                                                                                                                              T1112

                                                                                                                                                                                                                                              Credential Access

                                                                                                                                                                                                                                              Credentials from Password Stores

                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                              T1555

                                                                                                                                                                                                                                              Credentials from Web Browsers

                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                              T1555.003

                                                                                                                                                                                                                                              Unsecured Credentials

                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                              T1552

                                                                                                                                                                                                                                              Credentials In Files

                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                              T1552.001

                                                                                                                                                                                                                                              Discovery

                                                                                                                                                                                                                                              Peripheral Device Discovery

                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                              T1120

                                                                                                                                                                                                                                              Query Registry

                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                              T1012

                                                                                                                                                                                                                                              System Information Discovery

                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                              T1082

                                                                                                                                                                                                                                              System Location Discovery

                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                              T1614

                                                                                                                                                                                                                                              System Language Discovery

                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                              T1614.001

                                                                                                                                                                                                                                              Lateral Movement

                                                                                                                                                                                                                                              Collection

                                                                                                                                                                                                                                              Data from Local System

                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                              T1005

                                                                                                                                                                                                                                              Command and Control

                                                                                                                                                                                                                                              Exfiltration

                                                                                                                                                                                                                                              Impact

                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                              PkowgcAc.exe
                                                                                                                                                                                                                                              • Path C:\ProgramData\OwsUckMc\PkowgcAc.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 18a1c1bef5952c7876a101067629201586ca2a0637e72d6193b7e1521325d2f9
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              PkowgcAc.inf
                                                                                                                                                                                                                                              • Path C:\ProgramData\OwsUckMc\PkowgcAc.inf
                                                                                                                                                                                                                                              • Size 4B
                                                                                                                                                                                                                                              • SHA256 5bdc90901c8e29ae27b257c6ba39688b141759f1b65849f8fe1ce2bedaa992f4
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              PkowgcAc.inf
                                                                                                                                                                                                                                              • Path C:\ProgramData\OwsUckMc\PkowgcAc.inf
                                                                                                                                                                                                                                              • Size 4B
                                                                                                                                                                                                                                              • SHA256 bc0e3b767af0f85e9cc4ab511ae5de0e3a082d6d110dba8103bf5f5750a64d3f
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              PkowgcAc.inf
                                                                                                                                                                                                                                              • Path C:\ProgramData\OwsUckMc\PkowgcAc.inf
                                                                                                                                                                                                                                              • Size 4B
                                                                                                                                                                                                                                              • SHA256 d0856e5578c68ab4edc44089b41f0391405e11f4fa5e5ad97758111b4b001b9f
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              wKcYwIgM.exe
                                                                                                                                                                                                                                              • Path C:\ProgramData\dgIIscsE\wKcYwIgM.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 0a6ac509811de1216506f32514dab10b88b0f74e33a23d3a188f795aac9bb4a5
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              kcok.txt
                                                                                                                                                                                                                                              • Path C:\ProgramData\kcok.txt
                                                                                                                                                                                                                                              • Size 7KB
                                                                                                                                                                                                                                              • SHA256 6b6a8091e65f0dbbdbed5610f405fdf074270b0c9290cf8f1994b73768780779
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                                                                                              • Size 607B
                                                                                                                                                                                                                                              • SHA256 7c21835f01895c1ee4e12f81e71ef06a0f6e2b9281de493ff8ec95f913e9680d
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                                                                                              • Size 599B
                                                                                                                                                                                                                                              • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f746e1a64992a0caf494c51852ae922_elex_virlock
                                                                                                                                                                                                                                              • Size 588KB
                                                                                                                                                                                                                                              • SHA256 60ff5131dba68a8ffe7ba0475bf3e192b432e1969e5ac52d7f217f6935f4035d
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              PqgcwcEU.bat
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\PqgcwcEU.bat
                                                                                                                                                                                                                                              • Size 112B
                                                                                                                                                                                                                                              • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              file.vbs
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                                                                                                                                                                              • Size 19B
                                                                                                                                                                                                                                              • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              dmMMsscM.exe
                                                                                                                                                                                                                                              • Path C:\Users\Admin\HmEsAIwQ\dmMMsscM.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 4a122f16c64bc24c0bbe49e18e93d4dbad99afd5dc0a1445d7309d646deffa31
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              dmMMsscM.inf
                                                                                                                                                                                                                                              • Path C:\Users\Admin\HmEsAIwQ\dmMMsscM.inf
                                                                                                                                                                                                                                              • Size 4B
                                                                                                                                                                                                                                              • SHA256 8b1f030846398d3ef91b41dfb382b39484ab7282b74711f1fac9fec0876e1523
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              dmMMsscM.inf
                                                                                                                                                                                                                                              • Path C:\Users\Admin\HmEsAIwQ\dmMMsscM.inf
                                                                                                                                                                                                                                              • Size 4B
                                                                                                                                                                                                                                              • SHA256 0639cc13e68be8a1a1e7c139addfd4c0106a6352470f2e77dd46656ee2ddd1a2
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              AAEQ.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\AAEQ.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 6f9524189c5036367f206aa0d99ebe5a25bcde1869974adcc6101c29b184df25
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              AUAU.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\AUAU.exe
                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                              • SHA256 636c94916c6314aa32fc58c07dfc254af548e403d6e1c8dffbf30e8afa1f048b
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              AUIK.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\AUIK.exe
                                                                                                                                                                                                                                              • Size 2.7MB
                                                                                                                                                                                                                                              • SHA256 a2d08c1c6cdb49c279380c92a998a7ae48ad32ecb0c13a35cc999a932339a9cb
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              Awke.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\Awke.exe
                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                              • SHA256 e7337f1309f79f610d105c1c248a503a4f02069d3b3994ddd2557086241831ba
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              EAcu.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\EAcu.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 0860ea475d5a164c45ec9a4f916c1c6cb68ae4b2ac4875a7777e5d04ae2ea374
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              EQcY.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\EQcY.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 6c0cae1f74ccaf21d31723e1330fc1eb01d9e1c6414d9317e7595f13f958600e
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              EsIe.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\EsIe.exe
                                                                                                                                                                                                                                              • Size 2.6MB
                                                                                                                                                                                                                                              • SHA256 f8cd12f0857d4512a8010f739007408ef3aa45203b881b0a6344f7faaea71c15
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              GIIM.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\GIIM.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 238faff2998dc28f0d01ac08800e5a59cbdaf3d2c5fca038884144ea9f06df73
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              GQYQ.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\GQYQ.exe
                                                                                                                                                                                                                                              • Size 3.0MB
                                                                                                                                                                                                                                              • SHA256 ae10b239b5308aac977d104aae67b547269d9ae3b0d97983dda19ec3847dfbbe
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              GUEg.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\GUEg.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 c5d9ebe666e61f07561bc5ed8521d973c761fc4dd7d8783e888080dd3f2eb7b5
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              GUgQ.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\GUgQ.exe
                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                              • SHA256 0230117f6157633eb61e1199c84fe23d12c069b95d507a11b59b97547b93f74d
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              GgMO.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\GgMO.exe
                                                                                                                                                                                                                                              • Size 2.3MB
                                                                                                                                                                                                                                              • SHA256 f164b435c30bbbe66935cbf100077ff892bea5c2dd70ae6498118d396b074ce7
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              GwEM.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\GwEM.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 a0d7a35c7e00da63585f5b68f5cfb80f36e0bdb53c04c798bb9e6c45416efe33
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              IIEC.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\IIEC.exe
                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                              • SHA256 121a8964e52ff8937d373bdc9c6c19b6c8ce8c2f6724fa49b8d3f8771f198724
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              IMgm.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\IMgm.exe
                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                              • SHA256 9da09c299d51d51a37555549e170693cc8e4c3a86572f13203cb3114f9b4a7e4
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              IQIm.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\IQIm.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 5db3845190b13832e597da9d63465b4ab9c16141616a59854136533f23701620
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              IQYy.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\IQYy.exe
                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                              • SHA256 aacbd2812a575c85e8270d621afb452b492749e2ed6b6d29b7500fc5b13d49b9
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              IcEs.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\IcEs.exe
                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                              • SHA256 40989da80b24589504cacd3cf2f3a52385cfbc9bcd9bfb9019ea50ff34671729
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              Igsu.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\Igsu.exe
                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                              • SHA256 48badd0b1d15d4af34731a8434f7baebd2daf1932308c2baaa0531ed94b43b1e
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              KAoQ.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\KAoQ.exe
                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                              • SHA256 8ac1bb2cdfb2a0a43e8cad51a71c48c38facf7c39dac7ed1bd3fb070f586d41e
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              KUYM.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\KUYM.exe
                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                              • SHA256 7946a17edaf7b49a637e8cece16beebbdd76e5e772aaacd3b4a8f59adfb08587
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              KYgY.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\KYgY.exe
                                                                                                                                                                                                                                              • Size 2.6MB
                                                                                                                                                                                                                                              • SHA256 e6f534f0a4e2738b49f97cbbd9c24550610860168fece8584f0cb7e35007dfe7
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              KkMU.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\KkMU.exe
                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                              • SHA256 40cee36ae6f27e152fca2f095875348ba80ad09a4a8b1032b698296e79ba66b0
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              KoUC.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\KoUC.exe
                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                              • SHA256 e907e7faf93c82a3ba7cc8169a43ed9961e27570982260b022b214752ae1a2ad
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              KsUQ.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\KsUQ.exe
                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                              • SHA256 30d69ece15ddc6c099e60a2190d90968c80839285aa55fd1742dabd514ff5b50
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              MAUQ.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\MAUQ.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 b1aa8f37f1d355dfe977bb6b90455de36675a64ec2c583162b9a52b18b79d5e2
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              MAks.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\MAks.exe
                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                              • SHA256 df1910da0940d19a95a2334dd987a29bb3951d6b7626f5a0837c33777d58f9ae
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              MEQk.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\MEQk.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 53ebe366a173bf48f56ae9e91eb1808d989d434ccbe627ac84ad7ccf8d7a7795
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              MIoc.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\MIoc.exe
                                                                                                                                                                                                                                              • Size 2.3MB
                                                                                                                                                                                                                                              • SHA256 9173f5adc3e5255165625e3d5d267567b9b2cd24fc3cac6c319c44d09d8053f7
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              Mksi.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\Mksi.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 26dd9927503203d27d29712cb6486c06ef34b3501a308037a73515117f238865
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              MsEC.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\MsEC.exe
                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                              • SHA256 743e507c6409a8311bec42441441f82b477a3fa4bcdda89fbe828b2a7e5c97bc
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              OAsS.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\OAsS.exe
                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                              • SHA256 3e4974ddb4763376b9bd119cfcb8204d5824b8115402d93cd419221fe34a7c8a
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              OQIa.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\OQIa.exe
                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                              • SHA256 786715d433ac90d545605eeb32ae98b8e70f92865591094c83c58070c504d99c
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              OecA.ico
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\OecA.ico
                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                              • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              OkMu.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\OkMu.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 103d0756dcf98d1ab7ee3575e303f3693fd016b338ab84d7e71f1589b87fc962
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              Oock.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\Oock.exe
                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                              • SHA256 b928c1a0e7c55db1a039e92a49e78b2cbd1de0ab70335845246eae5511c6f16a
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              Qkcs.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\Qkcs.exe
                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                              • SHA256 0441356b4a7433443ed43d8e87cb76c1a3420bda4280905fbb7de9dfa2fa0448
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              QwAQ.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\QwAQ.exe
                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                              • SHA256 0bb4459250f0b01590a16ed4b74aa677a93921ed07bd700601a616dda872f282
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              SAEm.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\SAEm.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 5151017ba2397bfd4156e9247d6bf2c2b63db917b480d480a7adaa2228a73c74
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              SQwg.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\SQwg.exe
                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                              • SHA256 7ae21b009cddb71268acf4ba6308a691061a88acd6d764364c0a14013c5d2b6a
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              SckQ.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\SckQ.exe
                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                              • SHA256 e6368d3cf7f72d005a95ff06e1bd3771f09adfe84b120f56e43380ef03f6b7be
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              Sckq.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\Sckq.exe
                                                                                                                                                                                                                                              • Size 2.8MB
                                                                                                                                                                                                                                              • SHA256 3d486e9c2711d84dd22aa8f7c6e46dc19cb0250720d7581e294b489f6abb50e9
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              Sgky.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\Sgky.exe
                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                              • SHA256 1eb13477c145fbf8dc89251e33b4a727659f3659dd3738bd8c7fbc800063f309
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              Skgu.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\Skgu.exe
                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                              • SHA256 b1374a6ff90c04f90eb33e25285f92171ec2ccf3bba0531abe7b1202858d0d8a
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              Skki.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\Skki.exe
                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                              • SHA256 f72f5f9f2e519af0c3c67aa618bb25bc1948a78cff28aee258231c2cf7bfb175
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              SowY.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\SowY.exe
                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                              • SHA256 8a22929d57dcb2ac7a0058f5d4a28d110e06d4c1f2462809bfb58958b4bc555b
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              UIwC.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\UIwC.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 b1fbab4c88375ffa77ffbf905fab4328ae6d87540d25c9618afa0455f0eb0cb7
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              UOYM.ico
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\UOYM.ico
                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                              • SHA256 114dae4c54ca426f78e50998727dac92942261d71ca5b2dbaf413794dcf8ad82
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              UWsA.ico
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\UWsA.ico
                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                              • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              UsYK.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\UsYK.exe
                                                                                                                                                                                                                                              • Size 3.3MB
                                                                                                                                                                                                                                              • SHA256 0441a01f25ccd8100b841ad56a691e1146ac5397d64d259fbbcc2309fe60f2ae
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              WQcE.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\WQcE.exe
                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                              • SHA256 ba9fdb463b0373492f41baad27a23b6569321a56d7ce351d2839a0e529ee35c7
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              WUgc.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\WUgc.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 e22af5b5d6dda3e15b71932026348f1d17d4d003b2bc604d5c1e2774bd28cacf
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              WowS.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\WowS.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 8df9ca93972570bde98b4ef26a4c0a22e9f4e0de40789f13852f383b096b6ab2
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              WwgE.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\WwgE.exe
                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                              • SHA256 58dc81ba87bd2df681ad403c23b8abdbfbc8a685490195eae5513e92d69e6e6e
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              YcoY.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\YcoY.exe
                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                              • SHA256 b038ecf3d270f7f799c26cd204e9fbb92629c7124fd24f6b8da117801fa6baf3
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              aEwG.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\aEwG.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 78741854814a187beb57bd0cc5ce8ba9c8a485a550bce099a1075fb749d6e5b5
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              aMAK.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\aMAK.exe
                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                              • SHA256 21ae8f2aac14393e38b03514bb1f7abfd19cb4d86198587ec81f58617b852627
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              aUko.ico
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\aUko.ico
                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                              • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              aYwE.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\aYwE.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 3501f0617f4b81e587ea76f4434a6f5420af6955b89a1303a980a41625ac6d17
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              cMUm.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\cMUm.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 7cf9ec49c95d1fdd00b4f71ff4b3838c936a23a9c41f65c177141d7c6dcda9f8
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              cQwE.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\cQwE.exe
                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                              • SHA256 7d652c42c5a0cc96f3e1d6f5d75b109d866443f9a01a5245ef774bb9e86bb02d
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              cYwA.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\cYwA.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 240fc089c8fae31f7a4a4d2307944f31db2d1819eaedbfe126c27a14137c9186
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              ccQC.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\ccQC.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 d754b2e9e1802b09365107b4081cc6a4f2bb92e126fc2ab156b464c328408340
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              cgow.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\cgow.exe
                                                                                                                                                                                                                                              • Size 2.4MB
                                                                                                                                                                                                                                              • SHA256 74942e37c93aa7bc5935e34fafd9043fb6ac55d60fb3c13ba4fcf9c29e68c273
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              ciII.ico
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\ciII.ico
                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                              • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              cwEW.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\cwEW.exe
                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                              • SHA256 ddc9106e25e771bde9598763471d5bb8f59e0586a673fe532566197b43c4ff58
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              eAIc.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\eAIc.exe
                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                              • SHA256 ee21f8946946e8e9aec93d5118d9a56f227244baa6894ee09f2d1a43c1b340e8
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              eAQe.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\eAQe.exe
                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                              • SHA256 0ecb6b4dbad632a731323c4793aeeb9ad0c94bb6144628e8ec1031453e3d45b0
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              eIMo.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\eIMo.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 cbcf1ded91aa7e7815b4b1241b38e638826c8f853e7a14b49ada4a883168c7b7
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              eIgm.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\eIgm.exe
                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                              • SHA256 cbfc534d5cc95428d9b02af67d1907e0dba17cd5af2fc69c6b32b02801e3d63f
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              eMko.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\eMko.exe
                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                              • SHA256 f7133ac171e749bcb033a39f2c36e95bc16efe5e952ae43cd6cfbc57da6dd375
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              ecwE.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\ecwE.exe
                                                                                                                                                                                                                                              • Size 2.4MB
                                                                                                                                                                                                                                              • SHA256 5f1bfeeda55d6fe8455acfe8d387cf12605ec508dd86492cbf4862160517d5b5
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              eeMQ.ico
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\eeMQ.ico
                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                              • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              egcM.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\egcM.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 bf56e898f6cf314dfaefb39f9b5a3874afc846e18d6c8e93c7c17ec96a5bd823
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              esEW.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\esEW.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 ad6b05a8ef77abd472441001fcb1c21fcbcdf28188d1cbde311d4889642f84e9
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              gIYA.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\gIYA.exe
                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                              • SHA256 e16a5c3c53a0338b54860113c26d8df92c235bd6019dd3427eb7228e058ea4a1
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              gIsi.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\gIsi.exe
                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                              • SHA256 2ebb225bf93bf19d14e3ecb3a1b51370d2f32557a0428da07af471ebdafe3884
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              gMMq.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\gMMq.exe
                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                              • SHA256 645387efe43376956d0045e095cea67831b7aff30072223f47919a0a5fd59c86
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              gMYS.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\gMYS.exe
                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                              • SHA256 32e5c606f31beb8d16e0b3c6ea31b9db3f3d5557202ad531771888331683afbf
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              gMcU.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\gMcU.exe
                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                              • SHA256 3dac35b2c5804cd1f3c9877a9ef908ebea8743a54a92e5a755e00397ed975c56
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              gYss.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\gYss.exe
                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                              • SHA256 89a733a4f4933e1486c8a8662df15125d5d0327afcba9c32449241e7cc3a13a2
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              iIIO.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\iIIO.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 2ee24e4f4964e9a114e291fa08a5afcda106745f941b45607f1c3688e104e058
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              iMYG.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\iMYG.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 993af8e07c4e7cd5d144fa1aea2d2d14769013d27d3b13bc1bcd30206337076b
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              iMoK.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\iMoK.exe
                                                                                                                                                                                                                                              • Size 2.4MB
                                                                                                                                                                                                                                              • SHA256 1267f93a52c9e437290b9524d8d2624a084141148712dc2100bc7bce03553a37
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              iMwe.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\iMwe.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 d8084e48b017a6a718e761287c8384f1cd3bd9acf8c008f27a232c1d311a2db8
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              iQwc.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\iQwc.exe
                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                              • SHA256 98f7c1611a80e62c80a8b07d35d85f1bb2a659bfad9c66a38095a5239df6a682
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              iocU.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\iocU.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 a8c8022048e49574bd2ff2dbe38123c4e532403b53db5d4d4b56c3404f7d2be0
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              isEK.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\isEK.exe
                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                              • SHA256 00e6670e534ce715717ae3c7c728cd0eb14b5c56815cbdaa2aeab3e2c6ab9842
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              iwQg.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\iwQg.exe
                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                              • SHA256 b20060d57c5d9bbd483f3caa20b10d9fe1f878348186b5756bea44790b267d3d
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              iwwK.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\iwwK.exe
                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                              • SHA256 e2bf9ca33a7a3452f698661112d93b4509feceaa15646bcec089f52472e6ad7f
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              kCIo.ico
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\kCIo.ico
                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                              • SHA256 e1131246c60ad423586203bb8b9287e365051101ddbf532132bd47ef03ab86c8
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              kOYE.ico
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\kOYE.ico
                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                              • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              kUcU.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\kUcU.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 423006151c0b1bc6882b43fb2277400815cd9f1ff20c6de4bfaf873edc3bad20
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              kUwe.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\kUwe.exe
                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                              • SHA256 40c2b3b1c7e38925c34425d4df42af4ee51e316f23f3b2571588675571505a45
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              kYkA.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\kYkA.exe
                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                              • SHA256 8fda3ec5dcbbf987ccce19c591b01bd9f1f1cd078187c4150388efd6b92b9ecf
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              kcMc.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\kcMc.exe
                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                              • SHA256 de42ca8966516f120f281231e8e5ac9f54f4f252e6176516a4a346ea0ac14bcf
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              kwAc.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\kwAc.exe
                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                              • SHA256 d16e40c4f55d417597b47ab8d9917a4f15af5f4d2b00383bd3393fb95349eccd
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              kwwi.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\kwwi.exe
                                                                                                                                                                                                                                              • Size 3.1MB
                                                                                                                                                                                                                                              • SHA256 c0c25291a2d7112abc5922c29b4a183871e6f62f7b927d80a99af66ee1fc424b
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              mAsw.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\mAsw.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 d2424672f33d8733f44d0b645e0b15ebc840851740d1efdcd0545d26112cb2a0
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              mEQq.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\mEQq.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 104b1579ae9514f44a5be66ee5bce77705ce816bc8922ddba4a6bb9903d7c64d
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              mIgQ.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\mIgQ.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 698ffc3ecdb23f0213380c8e1db5f186c29731209283e29b42d545efcb9b96cf
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              mYkK.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\mYkK.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 2273fba0ba77ebaa7daaf599996abedc343215a5fd223bff4b7d937c0210925a
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              moQA.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\moQA.exe
                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                              • SHA256 579eef3a1209867a787dbda9551a65ddb21dce41aa2015e57153c8356674af24
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              oAgm.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\oAgm.exe
                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                              • SHA256 499f1858ffdb338f514fcadcf05e5c8d1af59d4d4a8fc0a4a4a652946c4ce18c
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              oEwm.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\oEwm.exe
                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                              • SHA256 411e3004e4f322a2bf981f0dbcae509bec7a368611a5a57f2b1d31baee0d9fdc
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              oMsE.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\oMsE.exe
                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                              • SHA256 89b4b6a48a73f2cc7d91afaf33f18ff5ed77ce92ca5cbe8ca52dbae3c1c18862
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              oMwo.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\oMwo.exe
                                                                                                                                                                                                                                              • Size 2.5MB
                                                                                                                                                                                                                                              • SHA256 746110e51c643ae4811f5b23f4c2b3c62a7771d298453455803062ec60d4c756
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              oUgE.ico
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\oUgE.ico
                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                              • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              oWks.ico
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\oWks.ico
                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                              • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              oYwO.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\oYwO.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 3e46b95805a215d3940ac0220b4422e46475d10bd3ecea8adc1e8476b8863c51
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              ogII.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\ogII.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 ffec126408bc61a6474377e931f63082ff03c6389a15f1abce278c6803ca4357
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              oksM.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\oksM.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 da4e25a0527792f52e8a683b49dd8ebbf948c35586f2f066fad03dff6e05997e
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              ooYo.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\ooYo.exe
                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                              • SHA256 71068adc76f814ee46396b4b1b618ddb1b7275eec95a7d46d0ae8173e6a77d33
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              qYsY.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\qYsY.exe
                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                              • SHA256 e66929c9b0b358381ff51e49e64a22e9b5d233dd833c2667bbebec9f4b24b6df
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              qYwy.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\qYwy.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 a896fd9ad7d69e0817ab582d51d8091e8ace92623086a66632410e1007a25960
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              qcga.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\qcga.exe
                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                              • SHA256 2b3ae099398139ca8c458734d0c0e01fcbbddce39a962ba5b2ffef8943dba69f
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              qoou.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\qoou.exe
                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                              • SHA256 c1d9dd446275aca0c908208c8806ac13d11495af8c38125df559f329f37f06e3
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              qsoG.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\qsoG.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 604d8d38a0631fcbdc483bbd59fbab2eb3e4d5028f2faaec3d1fdfdc3429e767
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              sAQs.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\sAQs.exe
                                                                                                                                                                                                                                              • Size 2.7MB
                                                                                                                                                                                                                                              • SHA256 82fdfcc104d037ade75b03dd643ab8871758a9e0b0e20fdaa5df367b90f8306a
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              sgoI.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\sgoI.exe
                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                              • SHA256 544fc15441e98e507d3209a0d215c0baa3323ed8cc362f382ca0340afc1c9a3f
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              sgoQ.ico
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\sgoQ.ico
                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                              • SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              skMo.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\skMo.exe
                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                              • SHA256 722d2aadbb9d2598b611f5524b8c94f391d98740c9e32eaf44debb2c89c73bf8
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              skoa.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\skoa.exe
                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                              • SHA256 549af4d02a34da58beb6b13c40c34b3ab585e3d08952eb27ac785b04d13f6592
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              uoQK.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\uoQK.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 aed30b6f3de4be87233201a4e160f70a097434194b4502aea82a13dbe71bb2f0
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              usIo.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\usIo.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 9eaac620f369f851afcafb15128535f185883f55d5faa210e6d4bf876abfc1cd
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              uwUI.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\uwUI.exe
                                                                                                                                                                                                                                              • Size 2.8MB
                                                                                                                                                                                                                                              • SHA256 c53b310494197b66e00e1621ffeabec1838974bacd6b24e17819842f48584af4
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              wMwu.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\wMwu.exe
                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                              • SHA256 e1351100bb79968e99b4bec2a53440021fdbfc3d55d96e78027956b04bf3b608
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              wQok.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\wQok.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 6ead16a31e52e4b0928ea89350aed5f566ee1b87edd9d0d1c5bd027a74a06f4a
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              wUMi.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\wUMi.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 23fd8a7aae86959add00e7cd9c9b5637f7e990cea600c6220b50ce99b5994bfd
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              wwkI.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\wwkI.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 cc1eb4066110f1413bff1f91feac0f70d4f1e774561bcaf31ffd92f1dbf59489
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              yYEk.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\yYEk.exe
                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                              • SHA256 325a830acd341c7d69d069989449f410f52150ccd4ce29c22f09adc8797b6adf
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              yoci.exe
                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\yoci.exe
                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                              • SHA256 abdd054c28d81377f7b8c73a278fa60de6309d6923a366640820f83c9b14bcf2
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              memory/252-63-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/596-256-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/696-139-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/756-95-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1044-247-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1076-50-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1144-235-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1224-22-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1224-2165-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1492-1764-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1508-1875-0x000001BD83C90000-0x000001BD83CB0000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1508-1870-0x000001BD83A30000-0x000001BD83A50000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1508-1844-0x000001BD801E0000-0x000001BD802E0000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1508-1898-0x000001BD946A0000-0x000001BD946C0000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1508-1871-0x000001BD93E90000-0x000001BD93F90000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1616-216-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1644-1807-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1732-155-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1804-184-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2016-1743-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2080-1752-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2336-1784-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2436-287-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2704-1797-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2704-1780-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2800-1816-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2800-1803-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2836-873-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2880-276-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2896-1731-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2996-32-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2996-33-0x0000000000800000-0x0000000000820000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2996-1-0x0000000000800000-0x0000000000820000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2996-0-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3224-83-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3268-265-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3412-7-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3412-2155-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3512-225-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3736-2170-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4704-171-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4732-2175-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4740-199-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5000-558-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5000-616-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5192-297-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5260-351-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5352-2160-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5352-17-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5556-127-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5596-1774-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5700-107-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5772-477-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/6084-963-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/6120-838-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                              Download