Overview

overview

10

Static

static

3

2026-07-06...ck.exe

windows10-2004-x64

10

2026-07-06...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    137s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/07/2026, 02:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe
  • Size 1.6MB
  • Sample260706-cf2b3acy6m
  • SHA256 079c0007c56a326835de8627db4c1a7a8fc2fafe88b9cd734c8552c25b3e10db
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverynabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 24 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 24 IoCs
    defense_evasiontrojan
  • Renames multiple (87) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3432
    • C:\Users\Admin\CuwUwgAo\bWYkQQAU.exe
      "C:\Users\Admin\CuwUwgAo\bWYkQQAU.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:1216
    • C:\ProgramData\BwkoQIQs\oOMYssMA.exe
      "C:\ProgramData\BwkoQIQs\oOMYssMA.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:5832
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:6060
      • C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5312
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1732
          • C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4396
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:3540
              • C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:5580
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1564
                  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:5436
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock"
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:4444
                      • C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock
                        11⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:5508
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock"
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4704
                          • C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:1568
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock"
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1848
                              • C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:624
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock"
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:5392
                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:4216
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock"
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3392
                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock
                                        19⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4308
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock"
                                          20⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:5616
                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock
                                            21⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3052
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock"
                                              22⤵
                                                PID:4928
                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe
                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock
                                                  23⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:3592
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock"
                                                    24⤵
                                                      PID:2936
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock
                                                        25⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:2724
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock"
                                                          26⤵
                                                            PID:964
                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe
                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock
                                                              27⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:1812
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock"
                                                                28⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4812
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock
                                                                  29⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:5772
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock"
                                                                    30⤵
                                                                      PID:3652
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock
                                                                        31⤵
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:1992
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock"
                                                                          32⤵
                                                                            PID:2856
                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock
                                                                              33⤵
                                                                                PID:2596
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock"
                                                                                  34⤵
                                                                                    PID:1924
                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock
                                                                                      35⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:3696
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock"
                                                                                        36⤵
                                                                                          PID:2900
                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            37⤵
                                                                                              PID:1888
                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock
                                                                                              37⤵
                                                                                                PID:1408
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock"
                                                                                                  38⤵
                                                                                                    PID:5916
                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                      39⤵
                                                                                                        PID:3228
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock
                                                                                                        39⤵
                                                                                                          PID:5176
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock"
                                                                                                            40⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:5336
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock
                                                                                                              41⤵
                                                                                                                PID:5028
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock"
                                                                                                                  42⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:3984
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock
                                                                                                                    43⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:4464
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock"
                                                                                                                      44⤵
                                                                                                                        PID:3836
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock
                                                                                                                          45⤵
                                                                                                                            PID:1276
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock"
                                                                                                                              46⤵
                                                                                                                                PID:5728
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock
                                                                                                                                  47⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:2700
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock"
                                                                                                                                    48⤵
                                                                                                                                      PID:4860
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                      48⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:4564
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                      48⤵
                                                                                                                                        PID:5928
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                        48⤵
                                                                                                                                        • UAC bypass
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        • Modifies registry key
                                                                                                                                        PID:1896
                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          49⤵
                                                                                                                                            PID:1796
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OsQMQAAE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe""
                                                                                                                                          48⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:5568
                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                            49⤵
                                                                                                                                              PID:5744
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                        46⤵
                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                        • Modifies registry key
                                                                                                                                        PID:2504
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                        46⤵
                                                                                                                                        • Modifies registry key
                                                                                                                                        PID:3280
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                        46⤵
                                                                                                                                        • UAC bypass
                                                                                                                                        PID:2484
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ViIYwcYI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe""
                                                                                                                                        46⤵
                                                                                                                                          PID:3300
                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                            47⤵
                                                                                                                                              PID:3752
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                        44⤵
                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                        • Modifies registry key
                                                                                                                                        PID:5996
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                        44⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        • Modifies registry key
                                                                                                                                        PID:5948
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                        44⤵
                                                                                                                                        • UAC bypass
                                                                                                                                        • Modifies registry key
                                                                                                                                        PID:1676
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DgAAAkwU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe""
                                                                                                                                        44⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:6076
                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                          45⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:1852
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                    42⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    • Modifies registry key
                                                                                                                                    PID:2300
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                    42⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    • Modifies registry key
                                                                                                                                    PID:5212
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                    42⤵
                                                                                                                                    • UAC bypass
                                                                                                                                    • Modifies registry key
                                                                                                                                    PID:4460
                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                      43⤵
                                                                                                                                        PID:3940
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YYsAwUwk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe""
                                                                                                                                      42⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:5216
                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                        43⤵
                                                                                                                                          PID:5064
                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                          43⤵
                                                                                                                                            PID:3416
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                      40⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:5676
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                      40⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:2264
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                      40⤵
                                                                                                                                      • UAC bypass
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:1896
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wGYQUgQU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe""
                                                                                                                                      40⤵
                                                                                                                                        PID:5524
                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                          41⤵
                                                                                                                                            PID:3900
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                      38⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:5360
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                      38⤵
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:2528
                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                        39⤵
                                                                                                                                          PID:5768
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                        38⤵
                                                                                                                                        • UAC bypass
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        • Modifies registry key
                                                                                                                                        PID:1092
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HkgQYksI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe""
                                                                                                                                        38⤵
                                                                                                                                          PID:4768
                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                            39⤵
                                                                                                                                              PID:4992
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                        36⤵
                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        • Modifies registry key
                                                                                                                                        PID:4820
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                        36⤵
                                                                                                                                        • Modifies registry key
                                                                                                                                        PID:5928
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                        36⤵
                                                                                                                                        • UAC bypass
                                                                                                                                        • Modifies registry key
                                                                                                                                        PID:3980
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GYcQwUkk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe""
                                                                                                                                        36⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:900
                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                          37⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:5776
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                    34⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    • Modifies registry key
                                                                                                                                    PID:2084
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                    34⤵
                                                                                                                                      PID:704
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                      34⤵
                                                                                                                                      • UAC bypass
                                                                                                                                      PID:2636
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QyUoEAcU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe""
                                                                                                                                      34⤵
                                                                                                                                        PID:5696
                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                          35⤵
                                                                                                                                            PID:2988
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                      32⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:6036
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                      32⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:1796
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                      32⤵
                                                                                                                                      • UAC bypass
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:3992
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jKcUwUEU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe""
                                                                                                                                      32⤵
                                                                                                                                        PID:6040
                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          33⤵
                                                                                                                                            PID:1868
                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                            33⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:3804
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                      30⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:1508
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                      30⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:1708
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                      30⤵
                                                                                                                                      • UAC bypass
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:560
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aeYwgEoA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe""
                                                                                                                                      30⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:1624
                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                        31⤵
                                                                                                                                          PID:2368
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                    28⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    PID:3940
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                    28⤵
                                                                                                                                    • Modifies registry key
                                                                                                                                    PID:2100
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                    28⤵
                                                                                                                                    • UAC bypass
                                                                                                                                    • Modifies registry key
                                                                                                                                    PID:3504
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vMoMEgoc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe""
                                                                                                                                    28⤵
                                                                                                                                      PID:1176
                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                        29⤵
                                                                                                                                          PID:4956
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                    26⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    PID:2592
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                    26⤵
                                                                                                                                    • Modifies registry key
                                                                                                                                    PID:5464
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                    26⤵
                                                                                                                                    • UAC bypass
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:3412
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OEMkskAc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe""
                                                                                                                                    26⤵
                                                                                                                                      PID:468
                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                        27⤵
                                                                                                                                          PID:3272
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                    24⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    • Modifies registry key
                                                                                                                                    PID:668
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                    24⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    • Modifies registry key
                                                                                                                                    PID:4944
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                    24⤵
                                                                                                                                    • UAC bypass
                                                                                                                                    • Modifies registry key
                                                                                                                                    PID:1924
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZiEcYwUc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe""
                                                                                                                                    24⤵
                                                                                                                                      PID:5240
                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                        25⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:1980
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                  22⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  • Modifies registry key
                                                                                                                                  PID:244
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                  22⤵
                                                                                                                                  • Modifies registry key
                                                                                                                                  PID:256
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                  22⤵
                                                                                                                                  • UAC bypass
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  • Modifies registry key
                                                                                                                                  PID:5768
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mwcwsIQs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe""
                                                                                                                                  22⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:1292
                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                    23⤵
                                                                                                                                      PID:2368
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                20⤵
                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                • Modifies registry key
                                                                                                                                PID:5820
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                20⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Modifies registry key
                                                                                                                                PID:1768
                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                  21⤵
                                                                                                                                    PID:1620
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                  20⤵
                                                                                                                                  • UAC bypass
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  • Modifies registry key
                                                                                                                                  PID:1852
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\suEUEsAs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe""
                                                                                                                                  20⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:3340
                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                    21⤵
                                                                                                                                      PID:4932
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                18⤵
                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                • Modifies registry key
                                                                                                                                PID:2808
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                18⤵
                                                                                                                                • Modifies registry key
                                                                                                                                PID:2240
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                18⤵
                                                                                                                                • UAC bypass
                                                                                                                                • Modifies registry key
                                                                                                                                PID:5460
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KSQggwgM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe""
                                                                                                                                18⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:1280
                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                  19⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:1868
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                            16⤵
                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Modifies registry key
                                                                                                                            PID:5972
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                            16⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Modifies registry key
                                                                                                                            PID:1708
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                            16⤵
                                                                                                                            • UAC bypass
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Modifies registry key
                                                                                                                            PID:4592
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NSMAkYAM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe""
                                                                                                                            16⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:5540
                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                              17⤵
                                                                                                                                PID:4276
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                          14⤵
                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:1888
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                          14⤵
                                                                                                                          • Modifies registry key
                                                                                                                          PID:2900
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                          14⤵
                                                                                                                          • UAC bypass
                                                                                                                          • Modifies registry key
                                                                                                                          PID:1176
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TsgMgoQc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe""
                                                                                                                          14⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:5824
                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                            15⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:2988
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                      12⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      • Modifies registry key
                                                                                                                      PID:5464
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                      12⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Modifies registry key
                                                                                                                      PID:5544
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                      12⤵
                                                                                                                      • UAC bypass
                                                                                                                      • Modifies registry key
                                                                                                                      PID:5064
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZQAgowos.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe""
                                                                                                                      12⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3688
                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                        13⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:2060
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                  10⤵
                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                  • Modifies registry key
                                                                                                                  PID:4756
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                  10⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Modifies registry key
                                                                                                                  PID:800
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                  10⤵
                                                                                                                  • UAC bypass
                                                                                                                  • Modifies registry key
                                                                                                                  PID:2700
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vsgUQosI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe""
                                                                                                                  10⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:6064
                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                    11⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:2920
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                              8⤵
                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Modifies registry key
                                                                                                              PID:2072
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                              8⤵
                                                                                                              • Modifies registry key
                                                                                                              PID:4904
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                              8⤵
                                                                                                              • UAC bypass
                                                                                                              • Modifies registry key
                                                                                                              PID:3300
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nQgwMQMA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe""
                                                                                                              8⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2796
                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                9⤵
                                                                                                                  PID:3228
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                            6⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            • Modifies registry key
                                                                                                            PID:1620
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                            6⤵
                                                                                                            • Modifies registry key
                                                                                                            PID:1932
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                            6⤵
                                                                                                            • UAC bypass
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Modifies registry key
                                                                                                            PID:1008
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tEwQwcko.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe""
                                                                                                            6⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2244
                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                              7⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:2404
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                        4⤵
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        • Modifies registry key
                                                                                                        PID:2352
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                        4⤵
                                                                                                        • Modifies registry key
                                                                                                        PID:3936
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                        4⤵
                                                                                                        • UAC bypass
                                                                                                        • Modifies registry key
                                                                                                        PID:2760
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\raYccksA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe""
                                                                                                        4⤵
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4896
                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                          5⤵
                                                                                                            PID:5948
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                      2⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      • Modifies registry key
                                                                                                      PID:4508
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                      2⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Modifies registry key
                                                                                                      PID:2348
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                      2⤵
                                                                                                      • UAC bypass
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Modifies registry key
                                                                                                      PID:4808
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vMYkAUsE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock.exe""
                                                                                                      2⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4876
                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                        3⤵
                                                                                                          PID:5232
                                                                                                    • C:\ProgramData\sSwcgEoA\jCogsEIM.exe
                                                                                                      C:\ProgramData\sSwcgEoA\jCogsEIM.exe
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Adds Run key to start application
                                                                                                      PID:1608
                                                                                                    • C:\Users\Admin\CuwUwgAo\bWYkQQAU.exe
                                                                                                      C:\Users\Admin\CuwUwgAo\bWYkQQAU.exe
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Adds Run key to start application
                                                                                                      • Drops file in System32 directory
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                      PID:5428
                                                                                                    • C:\ProgramData\BwkoQIQs\oOMYssMA.exe
                                                                                                      C:\ProgramData\BwkoQIQs\oOMYssMA.exe
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Adds Run key to start application
                                                                                                      PID:2044

                                                                                                    Network

                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                          Reconnaissance

                                                                                                          Resource Development

                                                                                                          Initial Access

                                                                                                          Execution

                                                                                                          Persistence

                                                                                                          Boot or Logon Autostart Execution

                                                                                                          1
                                                                                                          T1547

                                                                                                          Registry Run Keys / Startup Folder

                                                                                                          1
                                                                                                          T1547.001

                                                                                                          Privilege Escalation

                                                                                                          Abuse Elevation Control Mechanism

                                                                                                          1
                                                                                                          T1548

                                                                                                          Bypass User Account Control

                                                                                                          1
                                                                                                          T1548.002

                                                                                                          Boot or Logon Autostart Execution

                                                                                                          1
                                                                                                          T1547

                                                                                                          Registry Run Keys / Startup Folder

                                                                                                          1
                                                                                                          T1547.001

                                                                                                          Defense Evasion

                                                                                                          Abuse Elevation Control Mechanism

                                                                                                          1
                                                                                                          T1548

                                                                                                          Bypass User Account Control

                                                                                                          1
                                                                                                          T1548.002

                                                                                                          Hide Artifacts

                                                                                                          1
                                                                                                          T1564

                                                                                                          Hidden Files and Directories

                                                                                                          1
                                                                                                          T1564.001

                                                                                                          Impair Defenses

                                                                                                          1
                                                                                                          T1562

                                                                                                          Disable or Modify Tools

                                                                                                          1
                                                                                                          T1562.001

                                                                                                          Modify Registry

                                                                                                          4
                                                                                                          T1112

                                                                                                          Credential Access

                                                                                                          Credentials from Password Stores

                                                                                                          1
                                                                                                          T1555

                                                                                                          Credentials from Web Browsers

                                                                                                          1
                                                                                                          T1555.003

                                                                                                          Unsecured Credentials

                                                                                                          1
                                                                                                          T1552

                                                                                                          Credentials In Files

                                                                                                          1
                                                                                                          T1552.001

                                                                                                          Discovery

                                                                                                          System Information Discovery

                                                                                                          1
                                                                                                          T1082

                                                                                                          System Location Discovery

                                                                                                          1
                                                                                                          T1614

                                                                                                          System Language Discovery

                                                                                                          1
                                                                                                          T1614.001

                                                                                                          Lateral Movement

                                                                                                          Collection

                                                                                                          Data from Local System

                                                                                                          1
                                                                                                          T1005

                                                                                                          Command and Control

                                                                                                          Exfiltration

                                                                                                          Impact

                                                                                                          Replay Monitor

                                                                                                          Loading Replay Monitor...

                                                                                                          Downloads

                                                                                                          oOMYssMA.exe
                                                                                                          • Path C:\ProgramData\BwkoQIQs\oOMYssMA.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 edc7a525756a7cec599a00e0b1a552156ae87a0d5a74b594c41f8891aab0ab6d
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          PAYw.txt
                                                                                                          • Path C:\ProgramData\PAYw.txt
                                                                                                          • Size 8KB
                                                                                                          • SHA256 c56d839221d79822462865490e9d186577c218389049400db8fee8de12256848
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          jCogsEIM.exe
                                                                                                          • Path C:\ProgramData\sSwcgEoA\jCogsEIM.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 f7d698ff60b11011c59b7c2654e4c388c215d8ee306659076fb034bd1d95e3e1
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-07-06_95f7d07e3eb01593872f85253d9abc75_elex_virlock
                                                                                                          • Size 28KB
                                                                                                          • SHA256 5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          file.vbs
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                                          • Size 19B
                                                                                                          • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          vMYkAUsE.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\vMYkAUsE.bat
                                                                                                          • Size 112B
                                                                                                          • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          bWYkQQAU.exe
                                                                                                          • Path C:\Users\Admin\CuwUwgAo\bWYkQQAU.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 e52da966ceffbcfa6cc5f5143cf610e7fc7c4f8c67c294de1de36eed4b9d0be8
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          bWYkQQAU.inf
                                                                                                          • Path C:\Users\Admin\CuwUwgAo\bWYkQQAU.inf
                                                                                                          • Size 4B
                                                                                                          • SHA256 93296084c1acd730898cd446750c1139c0dad4d7e7d141badd9b2f9db67b3d19
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          bWYkQQAU.inf
                                                                                                          • Path C:\Users\Admin\CuwUwgAo\bWYkQQAU.inf
                                                                                                          • Size 4B
                                                                                                          • SHA256 7a84b82cb8093c1f1d711edda28408dd0dad40e44a874c3d0fe527af1aaa0476
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          bWYkQQAU.inf
                                                                                                          • Path C:\Users\Admin\CuwUwgAo\bWYkQQAU.inf
                                                                                                          • Size 4B
                                                                                                          • SHA256 89ae3b0786d1e67742c850efe067ac4dffc3093dc1af825cc9eabe75f6912f62
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          bWYkQQAU.inf
                                                                                                          • Path C:\Users\Admin\CuwUwgAo\bWYkQQAU.inf
                                                                                                          • Size 4B
                                                                                                          • SHA256 2634dbde8cbf482a7f05f193133fdee1fc2a4d93ec0f60e3d10555f41e6014a1
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          bWYkQQAU.inf
                                                                                                          • Path C:\Users\Admin\CuwUwgAo\bWYkQQAU.inf
                                                                                                          • Size 4B
                                                                                                          • SHA256 0d4dea3098afa184bf73193f6bfe094d3c52850fa2cd0c38861d148ac449b5a9
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          AEgE.ico
                                                                                                          • Path C:\Windows\SysWOW64\AEgE.ico
                                                                                                          • Size 4KB
                                                                                                          • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          AYwQ.exe
                                                                                                          • Path C:\Windows\SysWOW64\AYwQ.exe
                                                                                                          • Size 2.0MB
                                                                                                          • SHA256 6b777ad5e0a0fc8db1d25d67439c04024e878140afd2241819106e4c290b9596
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          BoQw.exe
                                                                                                          • Path C:\Windows\SysWOW64\BoQw.exe
                                                                                                          • Size 3.1MB
                                                                                                          • SHA256 4a0048036a4f8c8459b53b41191ce3270c3274cff7fc89cc0c6af6794c194389
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Bsky.exe
                                                                                                          • Path C:\Windows\SysWOW64\Bsky.exe
                                                                                                          • Size 1.8MB
                                                                                                          • SHA256 e3cfe8c3bed7657c6e1b7193e845ab4b892dc10e83396b4b28cbfe317ecf6a3a
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          CAgk.exe
                                                                                                          • Path C:\Windows\SysWOW64\CAgk.exe
                                                                                                          • Size 2.2MB
                                                                                                          • SHA256 bb12e34648acbd6e4e6625ceb9f8c4e104cb7739ece6b1fe4d1044853b64651d
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          CwES.exe
                                                                                                          • Path C:\Windows\SysWOW64\CwES.exe
                                                                                                          • Size 2.1MB
                                                                                                          • SHA256 6e9a9f1d6190a7497903ab131ec9b7ad30ce337ae5ef776555729ea05ea59a3b
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Dccu.exe
                                                                                                          • Path C:\Windows\SysWOW64\Dccu.exe
                                                                                                          • Size 2.0MB
                                                                                                          • SHA256 b2da21c97112aa7c73f980fae687a1b6ba653806d3103f0682ed5552c1103106
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Dogi.exe
                                                                                                          • Path C:\Windows\SysWOW64\Dogi.exe
                                                                                                          • Size 2.3MB
                                                                                                          • SHA256 851924802fc0c4572b2cec0a35c9d956c8718a67a624350ab6db5c7bda75bdff
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          EgMu.exe
                                                                                                          • Path C:\Windows\SysWOW64\EgMu.exe
                                                                                                          • Size 1.9MB
                                                                                                          • SHA256 37f8db264e808f59594939e48e097fa8bf514f6b6508a656ddaffd89f6c41c8c
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          EsUO.exe
                                                                                                          • Path C:\Windows\SysWOW64\EsUO.exe
                                                                                                          • Size 2.2MB
                                                                                                          • SHA256 4df6dabf89c658d8d064d8e69c833b718bb8f231df17e81ed523a980da5ee669
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          FsAm.exe
                                                                                                          • Path C:\Windows\SysWOW64\FsAm.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 1b320190d389ca6edc32f0152087d1a0fefbc1e177cdc3585dca2bfeabb7a3de
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          FwQA.exe
                                                                                                          • Path C:\Windows\SysWOW64\FwQA.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 46106805fca678c97c80717fd5a8eff06dfcb6bad102b6f4a1800ca325a6672b
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          GEAa.exe
                                                                                                          • Path C:\Windows\SysWOW64\GEAa.exe
                                                                                                          • Size 2.2MB
                                                                                                          • SHA256 c9597bdb88428288b61c5e937edddefff64933e5d4b62054dffc1359a2f33527
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          GgcC.exe
                                                                                                          • Path C:\Windows\SysWOW64\GgcC.exe
                                                                                                          • Size 2.1MB
                                                                                                          • SHA256 303b7caa459b7aabe9cc3198ccea20c7a94d505d74b12467d5ee9cada0fb30c6
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          HkEw.exe
                                                                                                          • Path C:\Windows\SysWOW64\HkEw.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 57900c6ecd57f91e3306ad208b692a3b5450d74bc0d3f17652c7c33a91f04aae
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          IEUg.exe
                                                                                                          • Path C:\Windows\SysWOW64\IEUg.exe
                                                                                                          • Size 2.5MB
                                                                                                          • SHA256 3717cda79a2efb65a04cb4b3cd89a50f2a6e8b1a8b5c71c1de10767a82c3cd76
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          IQIe.exe
                                                                                                          • Path C:\Windows\SysWOW64\IQIe.exe
                                                                                                          • Size 3.0MB
                                                                                                          • SHA256 c04e2cefdc43b8dd5c5191a958e89ad212eba573051fbf5ae382fea06415f317
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          KkUe.exe
                                                                                                          • Path C:\Windows\SysWOW64\KkUe.exe
                                                                                                          • Size 1.8MB
                                                                                                          • SHA256 bd84701222339f2a365f4317eab382f26d9b7eb09469a52e624f0a121f56f678
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          MUYu.exe
                                                                                                          • Path C:\Windows\SysWOW64\MUYu.exe
                                                                                                          • Size 1.9MB
                                                                                                          • SHA256 6d1f542635994173932247a5d010f4984af5116b89d9bfd4e8904cd64cc0ba57
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          MgQg.exe
                                                                                                          • Path C:\Windows\SysWOW64\MgQg.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 765df9d1cf40788d7c8f0bdb73267e2094e92905828d19dc85c5090a731791ce
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          NYYg.exe
                                                                                                          • Path C:\Windows\SysWOW64\NYYg.exe
                                                                                                          • Size 1.8MB
                                                                                                          • SHA256 fbb81f89a9fb5534a523730c58f377fa53255132957df90d7048c6a7d8dc761f
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          NYwI.exe
                                                                                                          • Path C:\Windows\SysWOW64\NYwI.exe
                                                                                                          • Size 2.2MB
                                                                                                          • SHA256 e513837d8579379f3ed2f373551084c5a01b9c7bde69944425878d9cb48bc12b
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          NYwy.exe
                                                                                                          • Path C:\Windows\SysWOW64\NYwy.exe
                                                                                                          • Size 2.0MB
                                                                                                          • SHA256 9d56e382f5f57e7fa36a22518581b285fd959fe50c11067bf7ba61eab8244146
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          OMoS.exe
                                                                                                          • Path C:\Windows\SysWOW64\OMoS.exe
                                                                                                          • Size 2.2MB
                                                                                                          • SHA256 bfea9ce882667b4f0c51ed3ee93b613762d394e42d3789b5f554752a9a87d4ac
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          OQEa.exe
                                                                                                          • Path C:\Windows\SysWOW64\OQEa.exe
                                                                                                          • Size 2.4MB
                                                                                                          • SHA256 d6bfc5a3733dd0433e8eacbdc50c1adbf55ae44a4169d2358bf79ae3bd403cb8
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          PYcA.exe
                                                                                                          • Path C:\Windows\SysWOW64\PYcA.exe
                                                                                                          • Size 2.0MB
                                                                                                          • SHA256 8f6a9315b588dfdaf4722af75c6867cd312e1ea210e1aa9372471b21af8297a4
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          PsIs.exe
                                                                                                          • Path C:\Windows\SysWOW64\PsIs.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 3d3250ab9a04abc2aef64033d292464e0247ca6f69eb426c04871775cc4fa274
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          QoQI.exe
                                                                                                          • Path C:\Windows\SysWOW64\QoQI.exe
                                                                                                          • Size 1.8MB
                                                                                                          • SHA256 99424d2532480d2a4eda8b72de0a24416919f83352e7048003977df03b8b8069
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          RMQq.exe
                                                                                                          • Path C:\Windows\SysWOW64\RMQq.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 cc50193796ec4fc3156603014ff1161ad472421935a0f986c9ac0c60420e28b3
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Rgwq.exe
                                                                                                          • Path C:\Windows\SysWOW64\Rgwq.exe
                                                                                                          • Size 1.9MB
                                                                                                          • SHA256 837404f49bcd0d207b930494202a2c542392c3ede57db5806e28cbd75fe3b1c9
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          RooK.exe
                                                                                                          • Path C:\Windows\SysWOW64\RooK.exe
                                                                                                          • Size 2.0MB
                                                                                                          • SHA256 69adad6a5bb8e620ecccd9554bcfad76fcf0eaaa1c0e210026198870825c3ffa
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          RwoI.exe
                                                                                                          • Path C:\Windows\SysWOW64\RwoI.exe
                                                                                                          • Size 2.2MB
                                                                                                          • SHA256 6848c5b87df0b261327e6f7918a831673253376fdbbdfac7d493959e948d39c1
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          SIsM.exe
                                                                                                          • Path C:\Windows\SysWOW64\SIsM.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 f944e01e3285114c06ef78251897bddeadb498ed9a12816a2792edfb1c9fcf5e
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          SUIW.exe
                                                                                                          • Path C:\Windows\SysWOW64\SUIW.exe
                                                                                                          • Size 1.7MB
                                                                                                          • SHA256 82fa2ee0598ecf927e2cd6c837599faf825f767a4be37f4d1a2cdd0d5630ae5c
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          SgIm.exe
                                                                                                          • Path C:\Windows\SysWOW64\SgIm.exe
                                                                                                          • Size 1.8MB
                                                                                                          • SHA256 d3f41a1323dbb0eff725b57d42e28192bbc016ea764e5633e6a2ff0ef0948bc5
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          SgYc.exe
                                                                                                          • Path C:\Windows\SysWOW64\SgYc.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 ce052c9fe8c8d919dffaa653c7270a370e218f61c2dfdd7ee9e020e924cd3b7e
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          SoMg.exe
                                                                                                          • Path C:\Windows\SysWOW64\SoMg.exe
                                                                                                          • Size 2.0MB
                                                                                                          • SHA256 c42f1083d152120f8e4ddf0bb1f67955bc9275e3ad338ffd25fa4987f8baecce
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          TesY.ico
                                                                                                          • Path C:\Windows\SysWOW64\TesY.ico
                                                                                                          • Size 4KB
                                                                                                          • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          UAoy.exe
                                                                                                          • Path C:\Windows\SysWOW64\UAoy.exe
                                                                                                          • Size 1.9MB
                                                                                                          • SHA256 a829290b7fb11e073d842ba22da2f3dad597fe12ed2a9af6015259407bd3009b
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          UEYA.exe
                                                                                                          • Path C:\Windows\SysWOW64\UEYA.exe
                                                                                                          • Size 1.9MB
                                                                                                          • SHA256 820b437547bc04d25e8ed5c21e74a500fb7e2ca03a5e9bdf005b52a4580268c4
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          UkQG.exe
                                                                                                          • Path C:\Windows\SysWOW64\UkQG.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 941bcfcb4e11578742c2fd7001101c8265895b7015661789a6ab897ccfff7271
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          WEcU.exe
                                                                                                          • Path C:\Windows\SysWOW64\WEcU.exe
                                                                                                          • Size 1.7MB
                                                                                                          • SHA256 d012482428e6ec06baf2cfad99d9eaf58d2a3b85b369d1b559e9b9ccbab05cef
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          WMEA.exe
                                                                                                          • Path C:\Windows\SysWOW64\WMEA.exe
                                                                                                          • Size 1.8MB
                                                                                                          • SHA256 6fd60960c4b2811efd7b59d320c97d9b0df35090b6cadaa141ca162616e8c885
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          WUUI.exe
                                                                                                          • Path C:\Windows\SysWOW64\WUUI.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 782ddfd76e3732f423ccecae0bb079405a81bbcb3baad06169075cb87c26dd62
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          WgsG.exe
                                                                                                          • Path C:\Windows\SysWOW64\WgsG.exe
                                                                                                          • Size 1.7MB
                                                                                                          • SHA256 7ac6042abb110bb3d8de0666e6727ed8d065ca8518bec5eaa1d1322aff09065b
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          WoEU.exe
                                                                                                          • Path C:\Windows\SysWOW64\WoEU.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 4abf1cb1a337487c5a5f1732ac945c404874823744104931969e309734aa7adc
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          WwIS.exe
                                                                                                          • Path C:\Windows\SysWOW64\WwIS.exe
                                                                                                          • Size 2.2MB
                                                                                                          • SHA256 a8ab33d96787f0c037d0b3079497328174395a295a8db6fba6ed3ec238a67781
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          XAMu.exe
                                                                                                          • Path C:\Windows\SysWOW64\XAMu.exe
                                                                                                          • Size 2.0MB
                                                                                                          • SHA256 ad293c92d95292d01116fc563893ba90862cf9159f85d80072c8ace470b1cb7c
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          XYEu.exe
                                                                                                          • Path C:\Windows\SysWOW64\XYEu.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 414d06785b9f270359a13069b951cea823527aa2d1ed1b0ff6dba88dc56f997e
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Xkga.exe
                                                                                                          • Path C:\Windows\SysWOW64\Xkga.exe
                                                                                                          • Size 1.8MB
                                                                                                          • SHA256 fdcd73a8858dd0f264ae57833677fe6cdd1fe7e6176d0713c85268c3da100112
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          YUko.exe
                                                                                                          • Path C:\Windows\SysWOW64\YUko.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 d9260541603fb66733470afa7c8b6671d43bc4e31b7cda8860f27176de0816eb
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          YYEI.exe
                                                                                                          • Path C:\Windows\SysWOW64\YYEI.exe
                                                                                                          • Size 2.3MB
                                                                                                          • SHA256 9c17279e01079752885013a93c8a14426b29b8746b347ad1438033cfd9261573
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          ZEsq.exe
                                                                                                          • Path C:\Windows\SysWOW64\ZEsq.exe
                                                                                                          • Size 2.3MB
                                                                                                          • SHA256 7bf7ca391fd28fd995120f343587139aaff4a0def97e01dd2c346fbf12bd3fe3
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          aIsI.exe
                                                                                                          • Path C:\Windows\SysWOW64\aIsI.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 c728b8fb756ed0682404b7a48c079839028322fd5db79075bdbf3c79a025988d
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          akky.exe
                                                                                                          • Path C:\Windows\SysWOW64\akky.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 4d8d673fab53a372bbf80e1ff5e4e79c6ba3d9c44de3390eb6ac7b3c09611b1e
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          bMgi.exe
                                                                                                          • Path C:\Windows\SysWOW64\bMgi.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 333fd0238771f98df3a08472c4ca5067d1c9fb6558db64c80ef0d1e2756e61e3
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          bkow.exe
                                                                                                          • Path C:\Windows\SysWOW64\bkow.exe
                                                                                                          • Size 1.7MB
                                                                                                          • SHA256 c3739f4a6125482ec06963274ad2f64eaaa4c10ad9865876af281a1e131c53c9
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          bksm.exe
                                                                                                          • Path C:\Windows\SysWOW64\bksm.exe
                                                                                                          • Size 1.8MB
                                                                                                          • SHA256 aa2392fb8d1dadb9aee6477f081c129a0a83533d2caf41bc87c362e9987bc4b2
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          bowq.exe
                                                                                                          • Path C:\Windows\SysWOW64\bowq.exe
                                                                                                          • Size 1.9MB
                                                                                                          • SHA256 ae7266c327771d049201ae1057a477dce3109f82ebdbb95ae3e42c9972611adc
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          ccwi.exe
                                                                                                          • Path C:\Windows\SysWOW64\ccwi.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 849d8bf44472f2deb606c0c07af071443952b4b22b79e1f1b13ce1583f3368ed
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          dQEq.exe
                                                                                                          • Path C:\Windows\SysWOW64\dQEq.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 55ded9b50691a8fab474a5d786c2b14f27c156fb636cbb16108256528cdc4e30
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          dogI.exe
                                                                                                          • Path C:\Windows\SysWOW64\dogI.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 e89b231028ca7b8055a3d6578485f8ccd6b4579cddf8f9d2e5b616e8401df701
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          eUwE.exe
                                                                                                          • Path C:\Windows\SysWOW64\eUwE.exe
                                                                                                          • Size 2.0MB
                                                                                                          • SHA256 5af802d4325302dc6bb77263e3cd57092bc285dfd38ac16b728a1b61a04271de
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          eiIY.ico
                                                                                                          • Path C:\Windows\SysWOW64\eiIY.ico
                                                                                                          • Size 4KB
                                                                                                          • SHA256 5963420fd9ba8c8248e3f50d179dfa21caca8538ad1482a03f260b27cf218043
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          ekMm.exe
                                                                                                          • Path C:\Windows\SysWOW64\ekMm.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 b6859be6a463023f062b21864787ec01d423569b59ce88851df8b0405d8f14f8
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          fAAo.exe
                                                                                                          • Path C:\Windows\SysWOW64\fAAo.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 0d6a67fa395e3ec96fa5d44a754567452cab08169227420ced064f900ba4eb46
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          fIAs.exe
                                                                                                          • Path C:\Windows\SysWOW64\fIAs.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 e41c6940810e67ed2094c701dd9701d0f9e926cb9f2e80f5665fe6d6748710a6
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          fQcA.exe
                                                                                                          • Path C:\Windows\SysWOW64\fQcA.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 343d630c852384b74d66f6ce152db08a90bdb4727413342d15618cef7dbe61e8
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          gAQa.exe
                                                                                                          • Path C:\Windows\SysWOW64\gAQa.exe
                                                                                                          • Size 2.4MB
                                                                                                          • SHA256 a2acd1c3f2492c50d0c9475f8f97854d858edcc406d71bc6ec47cb99c732a21c
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          gIIy.exe
                                                                                                          • Path C:\Windows\SysWOW64\gIIy.exe
                                                                                                          • Size 2.1MB
                                                                                                          • SHA256 989e960f405b3c4df53a69a7b04c239432d638d866950f3aa8afcc1f9cd68508
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          gQgK.exe
                                                                                                          • Path C:\Windows\SysWOW64\gQgK.exe
                                                                                                          • Size 1.8MB
                                                                                                          • SHA256 a13abe87bfb386799aea7fcd5bb8c46717e513e948f04575d2ccdf3618e9ec34
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          gYMg.exe
                                                                                                          • Path C:\Windows\SysWOW64\gYMg.exe
                                                                                                          • Size 2.1MB
                                                                                                          • SHA256 b89919196e0232ce87961e99a66f7af77d2635a4c48f00f3fc27d3259416084d
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          jEUO.exe
                                                                                                          • Path C:\Windows\SysWOW64\jEUO.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 d470c6c0168a194aee654d8c79c10e393da9041f8b4dff1b0fdc20b565c3fb44
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          lEMw.exe
                                                                                                          • Path C:\Windows\SysWOW64\lEMw.exe
                                                                                                          • Size 2.2MB
                                                                                                          • SHA256 3368a9752f67df1bacf6c6a97bbf2afb32fd0cd95ae730cb2bb56139285ab57e
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          mMEW.exe
                                                                                                          • Path C:\Windows\SysWOW64\mMEW.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 031ddc66d32200dd5a7ff9f56b3aada3668e77a3615ef18c0d05fa60d06c4d69
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          mgEe.exe
                                                                                                          • Path C:\Windows\SysWOW64\mgEe.exe
                                                                                                          • Size 2.4MB
                                                                                                          • SHA256 7cc3d08d5c7818184aaf16960dec9a97338c97f03090b71848d8109cab3a5e54
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          nAYw.exe
                                                                                                          • Path C:\Windows\SysWOW64\nAYw.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 15f7e9dd981af186b38d15b3f9fbdb75769a704cfdcb71bdea0599a9adb9cb03
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          nYYI.ico
                                                                                                          • Path C:\Windows\SysWOW64\nYYI.ico
                                                                                                          • Size 4KB
                                                                                                          • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          ngsK.exe
                                                                                                          • Path C:\Windows\SysWOW64\ngsK.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 3b27b31f9abb0039d5ee6a48be1cb6356e8611824ba829bec19e9fa75460c557
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          oQYe.exe
                                                                                                          • Path C:\Windows\SysWOW64\oQYe.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 f7ce5521dd590a3c56f67b0deab6c5d24967b18ac1cd6a415a16d965c19e0d3d
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          ooUw.exe
                                                                                                          • Path C:\Windows\SysWOW64\ooUw.exe
                                                                                                          • Size 2.2MB
                                                                                                          • SHA256 783f2f0b686e19f266f816146bce761aa96bf9cdf52e6349090899eb44b05c50
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          qEAG.exe
                                                                                                          • Path C:\Windows\SysWOW64\qEAG.exe
                                                                                                          • Size 2.2MB
                                                                                                          • SHA256 d1db7944c1bf91073b03c1f91fa99673db29bf25950b71a5e8d0120eeefef3e8
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          qIQo.exe
                                                                                                          • Path C:\Windows\SysWOW64\qIQo.exe
                                                                                                          • Size 1.8MB
                                                                                                          • SHA256 edc4a86eb3f43fbeb13c9d8bc08ab57f99e8395036d02a4a03043db57e8f6be6
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          qYQg.ico
                                                                                                          • Path C:\Windows\SysWOW64\qYQg.ico
                                                                                                          • Size 4KB
                                                                                                          • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          qgEa.exe
                                                                                                          • Path C:\Windows\SysWOW64\qgEa.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 e85b15d09129eae150811675f285a3988a61358744d14defb4e64c2bfc6a1918
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          qokY.exe
                                                                                                          • Path C:\Windows\SysWOW64\qokY.exe
                                                                                                          • Size 2.7MB
                                                                                                          • SHA256 6ce1d647795e2df96d98c83065a0662a0170557c9238a5827146ff3e4245e317
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          qsMW.exe
                                                                                                          • Path C:\Windows\SysWOW64\qsMW.exe
                                                                                                          • Size 1.9MB
                                                                                                          • SHA256 3059c3201acc9afc56152c8a378ac90c56bb859d174c8e220108c1222486b13a
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          rMMQ.ico
                                                                                                          • Path C:\Windows\SysWOW64\rMMQ.ico
                                                                                                          • Size 4KB
                                                                                                          • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          rcUQ.exe
                                                                                                          • Path C:\Windows\SysWOW64\rcUQ.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 ebbf05793fea824ee0d52b5ab6d91a09889808a83b7f655b0079371140329a5f
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          rcUs.exe
                                                                                                          • Path C:\Windows\SysWOW64\rcUs.exe
                                                                                                          • Size 2.3MB
                                                                                                          • SHA256 d25fa1d770228ee2f5480e57ff4ca334b115fe94a5347bc6d3a2176828fc565a
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          scsI.exe
                                                                                                          • Path C:\Windows\SysWOW64\scsI.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 e9f7e025d3852b4773eb16796398763583662922ac272f9c3d500d39d649c680
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          tAAU.exe
                                                                                                          • Path C:\Windows\SysWOW64\tAAU.exe
                                                                                                          • Size 2.0MB
                                                                                                          • SHA256 e37b8620508ff265681dadf47753569f9819799af48548954beef5b08da6aaaa
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          tAga.exe
                                                                                                          • Path C:\Windows\SysWOW64\tAga.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 3e96e5d2fe072b89948f6075c2cb802bf6187ccdacd5e0ec96e58c0098d0044a
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          tMwK.exe
                                                                                                          • Path C:\Windows\SysWOW64\tMwK.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 5cc5178f6018745e434b250d5695a73d607ef4ff05096ff677a561ad7e9ffd36
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          toMY.exe
                                                                                                          • Path C:\Windows\SysWOW64\toMY.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 33f477dcb7321ddf63edf71e4eeeecf84ef752e26b209f83cdc40be1480ad279
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          uEky.exe
                                                                                                          • Path C:\Windows\SysWOW64\uEky.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 9701c81c94219a4b3754644e0a3d921348f8a939000b6ece7cba91f7092f3381
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          vAMq.exe
                                                                                                          • Path C:\Windows\SysWOW64\vAMq.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 8ee726ec05cd4e78374d250add73c30e8178b767db00cc13719ad59bda94856f
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          vIIs.exe
                                                                                                          • Path C:\Windows\SysWOW64\vIIs.exe
                                                                                                          • Size 2.3MB
                                                                                                          • SHA256 1afe09f86094765f07d62509145543304d7590e9241e6989f7b0c576d93ba331
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          vkoW.exe
                                                                                                          • Path C:\Windows\SysWOW64\vkoW.exe
                                                                                                          • Size 1.7MB
                                                                                                          • SHA256 f7d9b917068e489ba90c3504dacc64363cd44134c20324f3bda0c8e9a0385465
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          vmgw.ico
                                                                                                          • Path C:\Windows\SysWOW64\vmgw.ico
                                                                                                          • Size 4KB
                                                                                                          • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          vwwK.exe
                                                                                                          • Path C:\Windows\SysWOW64\vwwK.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 e447420603119fc797bab71637b0aac1bc6a17888eeb38fd165a6176eac08310
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          wAsG.exe
                                                                                                          • Path C:\Windows\SysWOW64\wAsG.exe
                                                                                                          • Size 2.5MB
                                                                                                          • SHA256 a491ef797178b4d825b8c1e006cb5829ae07bd2f61c328fb5645ebef077150ba
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          wYQK.exe
                                                                                                          • Path C:\Windows\SysWOW64\wYQK.exe
                                                                                                          • Size 2.2MB
                                                                                                          • SHA256 d4e3fe34ad64c92ef2392c960080fc953417b524ad950e5edf7b830aa574b807
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          wYwA.exe
                                                                                                          • Path C:\Windows\SysWOW64\wYwA.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 a9513152c69bac90e863fe9ddeba7b122c6da4a8a52defbc55a86c7c7a095479
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          wwEm.exe
                                                                                                          • Path C:\Windows\SysWOW64\wwEm.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 c1001f2a93c27b4d3938b4b5aa3c1ece745e883b0148d3d183dc07e60c9d6b31
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          xAIW.exe
                                                                                                          • Path C:\Windows\SysWOW64\xAIW.exe
                                                                                                          • Size 2.0MB
                                                                                                          • SHA256 aa4e402e60d600ba1232c270f6bc81f7a27330f300b0b431de579221626a28ec
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          xMIc.exe
                                                                                                          • Path C:\Windows\SysWOW64\xMIc.exe
                                                                                                          • Size 2.0MB
                                                                                                          • SHA256 7ae5988c77e745add5bd7b133e3ba8af0c74828ce0c321776003daf293b5469f
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          xYEQ.exe
                                                                                                          • Path C:\Windows\SysWOW64\xYEQ.exe
                                                                                                          • Size 1.8MB
                                                                                                          • SHA256 aa0e6b720082a896bb2c6166b095f4d85b31d538507ba5ecb4ac273c0a1e12cd
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          xgYA.exe
                                                                                                          • Path C:\Windows\SysWOW64\xgYA.exe
                                                                                                          • Size 3.0MB
                                                                                                          • SHA256 9a655e7ddbf49f59085098f61623762799c529f315a2daf64ce122f90d4d9d00
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          xwIe.exe
                                                                                                          • Path C:\Windows\SysWOW64\xwIe.exe
                                                                                                          • Size 2.2MB
                                                                                                          • SHA256 791204c3d95089562a06c6105dbc2bcdb2fda51e1d26e2108bbb6c3ae96e8663
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          xwQS.exe
                                                                                                          • Path C:\Windows\SysWOW64\xwQS.exe
                                                                                                          • Size 2.0MB
                                                                                                          • SHA256 780f686a841758436ccfcbe935dce934f2c87a8a1a5f57f8f70e5ca23a15ef7b
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          xwoI.exe
                                                                                                          • Path C:\Windows\SysWOW64\xwoI.exe
                                                                                                          • Size 1.9MB
                                                                                                          • SHA256 f69ac5839dac1f1c3c14c025c39c1062cbf05bef03f82d27a128b394ca997cee
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          yQUo.ico
                                                                                                          • Path C:\Windows\SysWOW64\yQUo.ico
                                                                                                          • Size 4KB
                                                                                                          • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          ysUu.exe
                                                                                                          • Path C:\Windows\SysWOW64\ysUu.exe
                                                                                                          • Size 1.8MB
                                                                                                          • SHA256 aa636fb625744d97c4a398e4630ecb2dd857f24d06506cdd635335eb9e36b4e0
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          yssY.exe
                                                                                                          • Path C:\Windows\SysWOW64\yssY.exe
                                                                                                          • Size 2.5MB
                                                                                                          • SHA256 13a50094d6bc9bc260ca0b083def61df5123e6871a1f28f6fabee07da63c4c0c
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          zkYY.exe
                                                                                                          • Path C:\Windows\SysWOW64\zkYY.exe
                                                                                                          • Size 1.6MB
                                                                                                          • SHA256 a5359cacbd4ed5a40f66e696617eba7b77aa7383bf5185fe485c4f8a13799571
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          zoQA.exe
                                                                                                          • Path C:\Windows\SysWOW64\zoQA.exe
                                                                                                          • Size 2.3MB
                                                                                                          • SHA256 8413f0cd0adcccf61fd0a1fd897921c3185fe9010194d8c1e56931aaa2b1a28c
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          zsEG.exe
                                                                                                          • Path C:\Windows\SysWOW64\zsEG.exe
                                                                                                          • Size 2.2MB
                                                                                                          • SHA256 f60a93624e48c5ff054212206200c21817c9e99abce5cdd1bbc9836a96ff0a61
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          memory/624-140-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1216-1754-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1216-7-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1276-1548-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1408-578-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1408-652-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1568-123-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1608-19-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1608-1764-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1812-227-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1992-280-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2044-1778-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2596-443-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2700-1560-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2724-217-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3052-185-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3432-32-0x00000000041A0000-0x00000000041C0000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3432-31-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3432-0-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3432-1-0x00000000041A0000-0x00000000041C0000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3592-197-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3696-496-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4216-154-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4308-172-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4396-66-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4464-1538-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4464-1526-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5028-1530-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5176-1286-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5312-52-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5428-1769-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5436-96-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5508-110-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5580-84-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5772-249-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5832-17-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5832-1759-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                          Download