Overview

overview

10

Static

static

3

2026-07-08...ck.exe

windows10-2004-x64

10

2026-07-08...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    96s
  • max time network
    140s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 11:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
  • Size 1.7MB
  • Sample260708-nbne7aex3x
  • SHA256 54d54a01c2973cb4000b200b1010c7f57b72f5c9dbab067c31eb8d0c40a9c807
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoverynabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 30 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 30 IoCs
    defense_evasiontrojan
  • Renames multiple (122) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 62 IoCs
  • Suspicious use of FindShellTrayWindow 61 IoCs
  • Suspicious use of SendNotifyMessage 47 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3400
    • C:\Users\Admin\wYEsMgAc\YmAwYAAo.exe
      "C:\Users\Admin\wYEsMgAc\YmAwYAAo.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:3800
    • C:\ProgramData\dSMIIwsc\syIkoMMc.exe
      "C:\ProgramData\dSMIIwsc\syIkoMMc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:5844
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5884
      • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2740
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2544
          • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3552
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:676
              • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4044
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3532
                  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:2012
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2052
                      • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                        11⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:4048
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1352
                          • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                            13⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:2696
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5932
                              • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                                15⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:3740
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1524
                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:5544
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                                      18⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:3204
                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                                        19⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2892
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                                          20⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1668
                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                                            21⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3092
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:3184
                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                                                C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                                                23⤵
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:3216
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                                                  24⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3260
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                                                    25⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:240
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                                                      26⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2956
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                                                        27⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:2644
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                                                          28⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:5616
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                                                            29⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:2788
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                                                              30⤵
                                                                PID:5648
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                                                                  31⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:3516
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                                                                    32⤵
                                                                      PID:6096
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                                                                        33⤵
                                                                          PID:6072
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                                                                            34⤵
                                                                              PID:3972
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                                                                                35⤵
                                                                                  PID:252
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                                                                                    36⤵
                                                                                      PID:5504
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                                                                                        37⤵
                                                                                          PID:2268
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                                                                                            38⤵
                                                                                              PID:4392
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                                                                                                39⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:5412
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                                                                                                  40⤵
                                                                                                    PID:5008
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                                                                                                      41⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:1240
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                                                                                                        42⤵
                                                                                                          PID:2852
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                                                                                                            43⤵
                                                                                                              PID:1088
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                                                                                                                44⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:4488
                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  45⤵
                                                                                                                    PID:2444
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                                                                                                                    45⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:1168
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                                                                                                                      46⤵
                                                                                                                        PID:4408
                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                          47⤵
                                                                                                                            PID:4856
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                                                                                                                            47⤵
                                                                                                                              PID:5512
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                                                                                                                                48⤵
                                                                                                                                  PID:5432
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                                                                                                                                    49⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:5100
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                                                                                                                                      50⤵
                                                                                                                                        PID:2728
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                                                                                                                                          51⤵
                                                                                                                                            PID:1360
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                                                                                                                                              52⤵
                                                                                                                                                PID:6008
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                                                                                                                                                  53⤵
                                                                                                                                                    PID:1896
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                                                                                                                                                      54⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:4720
                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                        55⤵
                                                                                                                                                          PID:3720
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                                                                                                                                                          55⤵
                                                                                                                                                            PID:5548
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                                                                                                                                                              56⤵
                                                                                                                                                                PID:3684
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                                                                                                                                                                  57⤵
                                                                                                                                                                    PID:4448
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                                                                                                                                                                      58⤵
                                                                                                                                                                        PID:4092
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                                                                                                                                                                          59⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:4016
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock"
                                                                                                                                                                            60⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:776
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                            60⤵
                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                            PID:4864
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                            60⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                            PID:1236
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                            60⤵
                                                                                                                                                                            • UAC bypass
                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                            PID:5300
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hyQMswsQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                            60⤵
                                                                                                                                                                              PID:5928
                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                61⤵
                                                                                                                                                                                  PID:2504
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                            58⤵
                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                            PID:3504
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                            58⤵
                                                                                                                                                                              PID:616
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                              58⤵
                                                                                                                                                                              • UAC bypass
                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                              PID:3356
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AgIQAMAs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                              58⤵
                                                                                                                                                                                PID:2080
                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                  59⤵
                                                                                                                                                                                    PID:3372
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                              56⤵
                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                              PID:5396
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                              56⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                              PID:2896
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                              56⤵
                                                                                                                                                                              • UAC bypass
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:2464
                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                57⤵
                                                                                                                                                                                  PID:1548
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EMkgswgQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                                56⤵
                                                                                                                                                                                  PID:1532
                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                    57⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:2820
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                              54⤵
                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                              PID:4304
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                              54⤵
                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                              PID:360
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                              54⤵
                                                                                                                                                                              • UAC bypass
                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                              PID:4076
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zgwgwYEM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                              54⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:5476
                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                55⤵
                                                                                                                                                                                  PID:612
                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                  55⤵
                                                                                                                                                                                    PID:5448
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                              52⤵
                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                              PID:5988
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                              52⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:4512
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                              52⤵
                                                                                                                                                                              • UAC bypass
                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                              PID:2392
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uGUIAkAw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                              52⤵
                                                                                                                                                                                PID:5384
                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                  53⤵
                                                                                                                                                                                    PID:2532
                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                    53⤵
                                                                                                                                                                                      PID:5624
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                50⤵
                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                PID:1584
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                50⤵
                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                PID:5396
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                50⤵
                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                PID:2684
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eywQQkIE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                                50⤵
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:2312
                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                  51⤵
                                                                                                                                                                                    PID:1852
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                              48⤵
                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                              PID:2080
                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                49⤵
                                                                                                                                                                                  PID:2324
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                48⤵
                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                PID:2588
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                48⤵
                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                PID:1052
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RmcAUMMc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                                48⤵
                                                                                                                                                                                  PID:4148
                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                    49⤵
                                                                                                                                                                                      PID:1656
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                46⤵
                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                PID:4528
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                46⤵
                                                                                                                                                                                  PID:2992
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                  46⤵
                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                  PID:5040
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fckQQwAA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                                  46⤵
                                                                                                                                                                                    PID:5592
                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                      47⤵
                                                                                                                                                                                        PID:4072
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                  44⤵
                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                  PID:1532
                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                    45⤵
                                                                                                                                                                                      PID:2964
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                    44⤵
                                                                                                                                                                                      PID:4468
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                      44⤵
                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                      PID:2928
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eYsEQcUk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                                      44⤵
                                                                                                                                                                                        PID:3856
                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                          45⤵
                                                                                                                                                                                            PID:1384
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                      42⤵
                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                      PID:3944
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                      42⤵
                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                      PID:5668
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                      42⤵
                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                      PID:4776
                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                        43⤵
                                                                                                                                                                                          PID:5672
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ygwwgkkM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                                        42⤵
                                                                                                                                                                                          PID:1144
                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                            43⤵
                                                                                                                                                                                              PID:2368
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                        40⤵
                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                        PID:4652
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                        40⤵
                                                                                                                                                                                          PID:2156
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                          40⤵
                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                          PID:3272
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jgkEQscY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                                          40⤵
                                                                                                                                                                                            PID:468
                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                              41⤵
                                                                                                                                                                                                PID:1064
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                          38⤵
                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                          PID:1116
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                          38⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                          PID:1480
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                          38⤵
                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                          PID:1384
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lIUEcIwE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                                          38⤵
                                                                                                                                                                                            PID:1016
                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                              39⤵
                                                                                                                                                                                                PID:2772
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                          36⤵
                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                          PID:5560
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                          36⤵
                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                          PID:4972
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                          36⤵
                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                          PID:776
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XGQYUYAk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                                          36⤵
                                                                                                                                                                                            PID:6100
                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                              37⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:2160
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                        34⤵
                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                        PID:5000
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                        34⤵
                                                                                                                                                                                          PID:5436
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                          34⤵
                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                          PID:804
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EEgAMUwQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                                          34⤵
                                                                                                                                                                                            PID:2584
                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                              35⤵
                                                                                                                                                                                                PID:1548
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                          32⤵
                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                          PID:3444
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                          32⤵
                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                          PID:1080
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                          32⤵
                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:2324
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IgIMcIwk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                                          32⤵
                                                                                                                                                                                            PID:3392
                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                              33⤵
                                                                                                                                                                                                PID:612
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                          30⤵
                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                          PID:5912
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                          30⤵
                                                                                                                                                                                            PID:6000
                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                              31⤵
                                                                                                                                                                                                PID:2888
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                              30⤵
                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:1188
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SCUoosMw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                                              30⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:5324
                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                31⤵
                                                                                                                                                                                                  PID:5672
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                            28⤵
                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                            PID:4528
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                            28⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                            PID:3700
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                            28⤵
                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                            PID:4072
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JgAAEoAs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                                            28⤵
                                                                                                                                                                                              PID:1768
                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                29⤵
                                                                                                                                                                                                  PID:3872
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                            26⤵
                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                            PID:4856
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                            26⤵
                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                            PID:2156
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                            26⤵
                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                            PID:3264
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zgQwcggA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                                            26⤵
                                                                                                                                                                                              PID:408
                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                27⤵
                                                                                                                                                                                                  PID:3372
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                            24⤵
                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:2160
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                            24⤵
                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                            PID:2928
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                            24⤵
                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:2960
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lMsEwMUk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                                            24⤵
                                                                                                                                                                                              PID:4004
                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                25⤵
                                                                                                                                                                                                  PID:3500
                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                  25⤵
                                                                                                                                                                                                    PID:3016
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                              22⤵
                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                              PID:2796
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                              22⤵
                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                              PID:1192
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                              22⤵
                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                              PID:5504
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cWIwAAgI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                                              22⤵
                                                                                                                                                                                                PID:3248
                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                  23⤵
                                                                                                                                                                                                    PID:364
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                              20⤵
                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                              PID:1360
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                              20⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:2384
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                              20⤵
                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                              PID:3924
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YgIcEEUk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                                              20⤵
                                                                                                                                                                                                PID:2220
                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                  21⤵
                                                                                                                                                                                                    PID:5160
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                              18⤵
                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                              PID:2824
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                              18⤵
                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                              PID:2532
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                              18⤵
                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                              PID:3720
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iUAQkMQI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                                              18⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:1256
                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                19⤵
                                                                                                                                                                                                  PID:5656
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                            16⤵
                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                            PID:2992
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                            16⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                            PID:4192
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                            16⤵
                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                            PID:5040
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zgwQcgMc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                                            16⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                            PID:1512
                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                              17⤵
                                                                                                                                                                                                PID:2888
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                          14⤵
                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                          PID:5268
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                          14⤵
                                                                                                                                                                                            PID:4072
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                            14⤵
                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                            PID:4540
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BiskgsQo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                                            14⤵
                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                            PID:2836
                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                              15⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:3144
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                        12⤵
                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                        PID:2060
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                        12⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                        PID:5664
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                        12⤵
                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                        PID:4148
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XiUIEUkg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                                        12⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                        PID:1416
                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                          13⤵
                                                                                                                                                                                            PID:788
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                      10⤵
                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                      PID:2444
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                      10⤵
                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                      PID:3360
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                      10⤵
                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                      PID:3260
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\maEAwgIY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                                      10⤵
                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                      PID:1592
                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                        11⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:3500
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                  8⤵
                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                  PID:2964
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                  8⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                  PID:5504
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                  8⤵
                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:3216
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uecQEsYs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                                  8⤵
                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                  PID:1060
                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                    9⤵
                                                                                                                                                                                      PID:2268
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                PID:2392
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                PID:6112
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                6⤵
                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                PID:1780
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xccYMoEk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                PID:2196
                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                  7⤵
                                                                                                                                                                                    PID:5000
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                              4⤵
                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                              PID:5300
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                              4⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                              PID:3628
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                              4⤵
                                                                                                                                                                              • UAC bypass
                                                                                                                                                                              PID:4380
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bSYAogwo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                              4⤵
                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                              PID:3004
                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                5⤵
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:2324
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                          PID:6128
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                          PID:5708
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                          2⤵
                                                                                                                                                                          • UAC bypass
                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                          PID:5592
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ueoUocQQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock.exe""
                                                                                                                                                                          2⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                          PID:1032
                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:432
                                                                                                                                                                        • C:\ProgramData\TSIEAYUY\CycsgoUc.exe
                                                                                                                                                                          C:\ProgramData\TSIEAYUY\CycsgoUc.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                          PID:3540
                                                                                                                                                                        • C:\Users\Admin\wYEsMgAc\YmAwYAAo.exe
                                                                                                                                                                          C:\Users\Admin\wYEsMgAc\YmAwYAAo.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                          PID:2656
                                                                                                                                                                        • C:\ProgramData\dSMIIwsc\syIkoMMc.exe
                                                                                                                                                                          C:\ProgramData\dSMIIwsc\syIkoMMc.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                          PID:2784
                                                                                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                                                                                          C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:3272
                                                                                                                                                                          • C:\Windows\system32\sihost.exe
                                                                                                                                                                            sihost.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                            PID:832
                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                              explorer.exe /LOADSAVEDWINDOWS
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                              PID:4168
                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                            PID:3656
                                                                                                                                                                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                            PID:4352

                                                                                                                                                                          Network

                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                Reconnaissance

                                                                                                                                                                                Resource Development

                                                                                                                                                                                Initial Access

                                                                                                                                                                                Execution

                                                                                                                                                                                Persistence

                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                2
                                                                                                                                                                                T1547

                                                                                                                                                                                Active Setup

                                                                                                                                                                                1
                                                                                                                                                                                T1547.014

                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                1
                                                                                                                                                                                T1547.001

                                                                                                                                                                                Privilege Escalation

                                                                                                                                                                                Abuse Elevation Control Mechanism

                                                                                                                                                                                1
                                                                                                                                                                                T1548

                                                                                                                                                                                Bypass User Account Control

                                                                                                                                                                                1
                                                                                                                                                                                T1548.002

                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                2
                                                                                                                                                                                T1547

                                                                                                                                                                                Active Setup

                                                                                                                                                                                1
                                                                                                                                                                                T1547.014

                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                1
                                                                                                                                                                                T1547.001

                                                                                                                                                                                Defense Evasion

                                                                                                                                                                                Abuse Elevation Control Mechanism

                                                                                                                                                                                1
                                                                                                                                                                                T1548

                                                                                                                                                                                Bypass User Account Control

                                                                                                                                                                                1
                                                                                                                                                                                T1548.002

                                                                                                                                                                                Hide Artifacts

                                                                                                                                                                                1
                                                                                                                                                                                T1564

                                                                                                                                                                                Hidden Files and Directories

                                                                                                                                                                                1
                                                                                                                                                                                T1564.001

                                                                                                                                                                                Impair Defenses

                                                                                                                                                                                1
                                                                                                                                                                                T1562

                                                                                                                                                                                Disable or Modify Tools

                                                                                                                                                                                1
                                                                                                                                                                                T1562.001

                                                                                                                                                                                Modify Registry

                                                                                                                                                                                6
                                                                                                                                                                                T1112

                                                                                                                                                                                Credential Access

                                                                                                                                                                                Credentials from Password Stores

                                                                                                                                                                                1
                                                                                                                                                                                T1555

                                                                                                                                                                                Credentials from Web Browsers

                                                                                                                                                                                1
                                                                                                                                                                                T1555.003

                                                                                                                                                                                Unsecured Credentials

                                                                                                                                                                                1
                                                                                                                                                                                T1552

                                                                                                                                                                                Credentials In Files

                                                                                                                                                                                1
                                                                                                                                                                                T1552.001

                                                                                                                                                                                Discovery

                                                                                                                                                                                Peripheral Device Discovery

                                                                                                                                                                                2
                                                                                                                                                                                T1120

                                                                                                                                                                                Query Registry

                                                                                                                                                                                3
                                                                                                                                                                                T1012

                                                                                                                                                                                System Information Discovery

                                                                                                                                                                                3
                                                                                                                                                                                T1082

                                                                                                                                                                                System Location Discovery

                                                                                                                                                                                1
                                                                                                                                                                                T1614

                                                                                                                                                                                System Language Discovery

                                                                                                                                                                                1
                                                                                                                                                                                T1614.001

                                                                                                                                                                                Lateral Movement

                                                                                                                                                                                Collection

                                                                                                                                                                                Data from Local System

                                                                                                                                                                                1
                                                                                                                                                                                T1005

                                                                                                                                                                                Command and Control

                                                                                                                                                                                Exfiltration

                                                                                                                                                                                Impact

                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                Downloads

                                                                                                                                                                                CycsgoUc.exe
                                                                                                                                                                                • Path C:\ProgramData\TSIEAYUY\CycsgoUc.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 03f3c5e7d43efe1b455bae64ecc9063f084a32868b2b84830fe3decdab619706
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                syIkoMMc.exe
                                                                                                                                                                                • Path C:\ProgramData\dSMIIwsc\syIkoMMc.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 be59e1b6bca94ad1b2ae49741c235240bb0d4ba2a95b834fb320b55c67fcfdad
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                syIkoMMc.inf
                                                                                                                                                                                • Path C:\ProgramData\dSMIIwsc\syIkoMMc.inf
                                                                                                                                                                                • Size 4B
                                                                                                                                                                                • SHA256 f66113f4b82e78fa642b473519674a8c9ec9b56f5bbc4e812f23915398022803
                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                Submit Download

                                                                                                                                                                                syIkoMMc.inf
                                                                                                                                                                                • Path C:\ProgramData\dSMIIwsc\syIkoMMc.inf
                                                                                                                                                                                • Size 4B
                                                                                                                                                                                • SHA256 1645254c018a1349a8af3ed0e03194626a7b06525b7810f8475c56fc9356966b
                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                Submit Download

                                                                                                                                                                                syIkoMMc.inf
                                                                                                                                                                                • Path C:\ProgramData\dSMIIwsc\syIkoMMc.inf
                                                                                                                                                                                • Size 4B
                                                                                                                                                                                • SHA256 55d5d67f528c38586aedf75c09a89824b3bb4c4a8fdf4c9e72f0b334696e73c4
                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                Submit Download

                                                                                                                                                                                yUYw.txt
                                                                                                                                                                                • Path C:\ProgramData\yUYw.txt
                                                                                                                                                                                • Size 8KB
                                                                                                                                                                                • SHA256 c56d839221d79822462865490e9d186577c218389049400db8fee8de12256848
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                                • Size 599B
                                                                                                                                                                                • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
                                                                                                                                                                                • Size 126KB
                                                                                                                                                                                • SHA256 d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                bSYAogwo.bat
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\bSYAogwo.bat
                                                                                                                                                                                • Size 112B
                                                                                                                                                                                • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                file.vbs
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                                                                                                                • Size 19B
                                                                                                                                                                                • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                Submit Download

                                                                                                                                                                                YmAwYAAo.exe
                                                                                                                                                                                • Path C:\Users\Admin\wYEsMgAc\YmAwYAAo.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 ccd37b26cf114b868188b6b51690ae456c6e30404e7030c660143df2e038293c
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                YmAwYAAo.inf
                                                                                                                                                                                • Path C:\Users\Admin\wYEsMgAc\YmAwYAAo.inf
                                                                                                                                                                                • Size 4B
                                                                                                                                                                                • SHA256 6c3bf7ac4ccf1f1334fafeafaf18d97c02e457d8a7268c6a43cb73ce4aa10a1b
                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                Submit Download

                                                                                                                                                                                YmAwYAAo.inf
                                                                                                                                                                                • Path C:\Users\Admin\wYEsMgAc\YmAwYAAo.inf
                                                                                                                                                                                • Size 4B
                                                                                                                                                                                • SHA256 71f50f84a0f34a62331f23befef2eedb861bc0531bf75c08678c4afbee9fadbb
                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                Submit Download

                                                                                                                                                                                YmAwYAAo.inf
                                                                                                                                                                                • Path C:\Users\Admin\wYEsMgAc\YmAwYAAo.inf
                                                                                                                                                                                • Size 4B
                                                                                                                                                                                • SHA256 35645655a9561fa86bb0d229b1184f46899547536a5b41fe53f3f9462957ed2d
                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                Submit Download

                                                                                                                                                                                YmAwYAAo.inf
                                                                                                                                                                                • Path C:\Users\Admin\wYEsMgAc\YmAwYAAo.inf
                                                                                                                                                                                • Size 4B
                                                                                                                                                                                • SHA256 c196527a8f2cb192cc56d1779d4194531bf2e05dd686005435c6c4e496bc0768
                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                Submit Download

                                                                                                                                                                                AAIO.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\AAIO.exe
                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                • SHA256 86ecca89e0222c9c328fd1fc1e33ed01c7cca382cfcdb6522e0844e4a3a908e6
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                AEEm.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\AEEm.exe
                                                                                                                                                                                • Size 2.3MB
                                                                                                                                                                                • SHA256 4ce306aa980cdd4b11fc544823c6f594bcccb81646515a53392e81bd5f9ae9c5
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                AUca.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\AUca.exe
                                                                                                                                                                                • Size 2.5MB
                                                                                                                                                                                • SHA256 52b434aeba92b58c9990c8f9926f9e58575a8b2ee0e39b18e559d9cb0bd09092
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                AUse.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\AUse.exe
                                                                                                                                                                                • Size 2.1MB
                                                                                                                                                                                • SHA256 b440b5f3050ec56ddb495189c5f613acf7248ad2d9f3fcee1213c10c71938105
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                AYYg.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\AYYg.exe
                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                • SHA256 ce739672de11b853de1c5ef95822afb26d8c65aa1be571dddfca6020164768ac
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                CAYG.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\CAYG.exe
                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                • SHA256 93a2b1aab6c76c4ff7c643f67021b5c044fbfebfe1b0a2bf966968281bfe6af2
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                CEAM.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\CEAM.exe
                                                                                                                                                                                • Size 2.2MB
                                                                                                                                                                                • SHA256 a3b6d4b933935e3b677650969fcf22ab38007eb3619ae4d702fb6b3fbe9f441a
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                CYEC.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\CYEC.exe
                                                                                                                                                                                • Size 2.7MB
                                                                                                                                                                                • SHA256 0bafc1a1d713c6cab1ec966031ba670a9b51037d8dc0859fad14e2155c2d4d36
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                CYgM.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\CYgM.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 7f8e91206b241343bdced9c6959c79a545539162df41732dab6c590d8522cc5a
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                CwUm.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\CwUm.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 4fa2e0ed8141b20f935ed1f1e20752439bc4139d35c565ea3f0cab0d3b8213d5
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                EEUc.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\EEUc.exe
                                                                                                                                                                                • Size 2.3MB
                                                                                                                                                                                • SHA256 19e3e93037f9817990b868201bcf83a3105143bd46ea4a2bc33240d5934d9d73
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                EMYE.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\EMYE.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 6d30ff821ab5a288dd30bea12bccc3d284cab54ae2a2ef6048799161e156d12e
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                EUsa.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\EUsa.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 e623dc70b26f9fa415e3252f42bb3e3af33b34d500ede790110107dadf0094b3
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                EeQg.ico
                                                                                                                                                                                • Path C:\Windows\SysWOW64\EeQg.ico
                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                • SHA256 e1131246c60ad423586203bb8b9287e365051101ddbf532132bd47ef03ab86c8
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                EgIu.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\EgIu.exe
                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                • SHA256 de442855fdec8ef1fa515000403b03833829cfe627fc8919c60337c1e950d006
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                EgQm.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\EgQm.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 950e19d7d13eba4f109c72dbcaf4abb783a2c383ee99033785f2d7dc02110a50
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                Eogw.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\Eogw.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 f0c9e0f9a71ff3a680d88ac737b312d345c37614f2067305618bfda41aa9ee90
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                EsUG.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\EsUG.exe
                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                • SHA256 862211639f0390c26a897c8197e902c0a4cd117ef5b4c4ac41bbce3c8fb9ba10
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                Eswc.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\Eswc.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 bbe98edcdd18b8d8f76f5af4ce7edf7cabd9462826b865b3f2cf1fd3a4357223
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                GMEC.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\GMEC.exe
                                                                                                                                                                                • Size 2.5MB
                                                                                                                                                                                • SHA256 e33feacf4a7c28b74fe87892ab26b0dbedbffff469a5029b0cec0e6b888481fd
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                GMsQ.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\GMsQ.exe
                                                                                                                                                                                • Size 2.5MB
                                                                                                                                                                                • SHA256 b9bb5ac4e840815e3d9d755341206f4fce893e97a1f5120ea5184d7058a1277d
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                GQYa.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\GQYa.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 21d1f7768c2d9378422401a3b009859c923b44f15d45a303d6a5b69a852594bc
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                GUgY.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\GUgY.exe
                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                • SHA256 ad93b24d55c13f0f726126e7c83d7a55cde5d6d001275e99279653f0d88afed7
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                GgAo.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\GgAo.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 270dfe1a60f0be35b89b0a640edb75cafdc4a3bd869694e1c1e5f203d7f5b55e
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                GgYs.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\GgYs.exe
                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                • SHA256 cf8523afb9be59b5546e936f160ba95f1c58cb72d022e5566b2aff16e0e7d306
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                GkAw.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\GkAw.exe
                                                                                                                                                                                • Size 2.2MB
                                                                                                                                                                                • SHA256 423edbf58df1208ec70802595ef7e425968c227aeb86e1043e5896f6f66768ec
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                GsEm.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\GsEm.exe
                                                                                                                                                                                • Size 2.1MB
                                                                                                                                                                                • SHA256 a24f93e1cca3c433a93f439e0f8b5b89b48fd6bef469f37f4f79ff4fa33ce7f4
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                GsUm.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\GsUm.exe
                                                                                                                                                                                • Size 2.4MB
                                                                                                                                                                                • SHA256 08be2abb3d8327fafeaf42d7dc4bf3eb61ce576210b7513998d4a4f3f3ae381d
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                IAMQ.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\IAMQ.exe
                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                • SHA256 606308c1f5f3013a3ed2787a6a3fec020bb2494586e6f3d3875d8a35c616ee75
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                IEYQ.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\IEYQ.exe
                                                                                                                                                                                • Size 2.2MB
                                                                                                                                                                                • SHA256 b9d45434e18aa740d2ddf644f37ee1e91c04f177d4ecdc9a94f909887074f17f
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                IIIq.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\IIIq.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 5bd99296281dcadfcd2f8080e09fdf58de4247759bac8f6f7d96413f1ef58c2d
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                IQwI.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\IQwI.exe
                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                • SHA256 c14290e4ad588e0f08deb60b89a20c6d0c732b33880748187dcb6c13e1ec59f6
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                IoMS.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\IoMS.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 1c03e8dc75888fc09e9ad43632feba767365eba2af89087fe202fc459490a351
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                KAIG.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\KAIG.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 5c4fd05c3a2f1f01d107caf316a6b9d5cd7ec06ef47512e6afcf62e25a3332c9
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                KUMI.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\KUMI.exe
                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                • SHA256 261f3de1028785f8d57e4f951ffa3553e41628315428eca7a0b3ca5cbb87a13e
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                KgQw.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\KgQw.exe
                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                • SHA256 9aa20f7c086121dad4b8bfa92ba77abc2b27e2b88efa8d80ce75627177363bd2
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                MAww.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\MAww.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 93cce544a04d27fa9c91c3f2a3c63eee09bab601c6759d3b4221284a6180233f
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                MYAu.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\MYAu.exe
                                                                                                                                                                                • Size 3.2MB
                                                                                                                                                                                • SHA256 0187831d2c37fed5f2d7fb5ee6bd262cfa1194821fc8c4073f26ae391b262d0d
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                Maco.ico
                                                                                                                                                                                • Path C:\Windows\SysWOW64\Maco.ico
                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                MckI.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\MckI.exe
                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                • SHA256 7d2624cf349fbb9e566f1793408cfd82d292961b12a7ad9d9b3afe0a61792341
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                MogI.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\MogI.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 d034e776e0b903ab045ce2372caceabd60891da4dd9aaea045ad999bc9eaa321
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                OEIw.ico
                                                                                                                                                                                • Path C:\Windows\SysWOW64\OEIw.ico
                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                OIYI.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\OIYI.exe
                                                                                                                                                                                • Size 2.2MB
                                                                                                                                                                                • SHA256 c0d13d3f0c1337090e4301c2607e18f4c4066e995e6cc5716df6bb8912df8031
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                OIgo.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\OIgo.exe
                                                                                                                                                                                • Size 2.4MB
                                                                                                                                                                                • SHA256 3bfd77b1aa9cc9aa3e1dbd3b27ca3cc949be39172c939bba92d692bbdba5962b
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                OYMS.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\OYMS.exe
                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                • SHA256 f67dde18b3972f1d659883c0fd91d50dfc22736c38b65354cdcbc3451d41054e
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                OcsW.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\OcsW.exe
                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                • SHA256 9ae4b1218d213962a8d35d5c6c0d29f7861b48bac7c5c6913c98944628156be1
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                OgIW.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\OgIW.exe
                                                                                                                                                                                • Size 2.2MB
                                                                                                                                                                                • SHA256 94b73348a86ccef093a3e4ad87e6334dee999acd419491d15bbcc8c9b989266d
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                Owgs.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\Owgs.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 23d7e97ef789e0432728c7f6fcc4a1eeb38f25f9d2f23c0aa6855f36bbeb2d22
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                OwoO.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\OwoO.exe
                                                                                                                                                                                • Size 2.4MB
                                                                                                                                                                                • SHA256 735f6ae90c17947d77e049dbde2cb80451f8760666aa681510aa07c0ad8fa340
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                QQcA.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\QQcA.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 70b1ea7cae73ef31d445b6223d57e6ab5e211d50488a750279c97ef68ccf238f
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                QwMk.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\QwMk.exe
                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                • SHA256 c57d03513fbf2346938490fc1e120167dc9e70db70a570b6970176b8aaef803e
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                SMYE.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\SMYE.exe
                                                                                                                                                                                • Size 2.2MB
                                                                                                                                                                                • SHA256 3f09e40c97e62f525d0010bef3fdd62c893b3d6c20448431a5c35bc7f7c72b97
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                SQMU.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\SQMU.exe
                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                • SHA256 a9ed41414061c95308a3bea0d818ba30829ba0d4198c546709129540c871b77c
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                SggS.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\SggS.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 a2d3cc0bb40fd5e26a7193c0e36b029049c49bb0acc530d3ff4b5a14b411c56a
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                SoEA.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\SoEA.exe
                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                • SHA256 4dc1b0e270f580b42f12e3a11f47dd183c3dd678943606fcfcb17ac8a4f7b269
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                SoYK.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\SoYK.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 3919361b5c55d9c58e8a0e14959d032f6f335e622accf3b2cbf258a75a0feb23
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                SwYe.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\SwYe.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 b4f3d88197bab135f3043fc7a3ac3bd8abdb4bd584b352ad9873c826fac55b36
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                SwoA.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\SwoA.exe
                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                • SHA256 561bafe7f9f1e815dbac60bd6179f99488fe932d23c0d9c166c2b9649215ca42
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                UoEs.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\UoEs.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 450363485ef474270314c9b7b0a3b14ffdd54ccc77e860c09a32f2e340f1734f
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                UoQU.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\UoQU.exe
                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                • SHA256 31c197ff79c465b3fb95251b15612c6576f8d44244b27b802e8da3d106cfe5bc
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                Uogy.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\Uogy.exe
                                                                                                                                                                                • Size 4.1MB
                                                                                                                                                                                • SHA256 9e87db774e1772d47d95b1f08c43f5bb6c76baa3ee1d3acba8934ee322353fde
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                Uowk.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\Uowk.exe
                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                • SHA256 8bbb754b0f4f482eeba6faa6302f419106c7bdc2ed3a553cdfce14904a6e407a
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                WIUY.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\WIUY.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 6475cfd05da0a6fa54099c05651e92015071acdc93584cf2e987e062e342f9d3
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                WIwq.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\WIwq.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 6e32e7d96570dfd9fe55c08265efafe8486afce40902ea84bcf8740b0bcf56e7
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                WMcc.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\WMcc.exe
                                                                                                                                                                                • Size 2.1MB
                                                                                                                                                                                • SHA256 663cae76b088daa814190ddb6efeed662ee3ee7ad5665cdf6d5e5761486f2f9e
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                WUAe.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\WUAe.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 ddd7c0bcd34000fab1dadbe94dae83809fdb467d1c433c42e1230826c1fdd09e
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                Wwsa.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\Wwsa.exe
                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                • SHA256 bb399b66185bf689220eb9225c7955bc84340937a96a8c33a48f2c3a42d5171a
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                YAEu.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\YAEu.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 d68b0fdd3737472b53754752bf58f3dd008bb32d21952757197bffce3c63320f
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                YAMC.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\YAMC.exe
                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                • SHA256 5061787b1c5046d4355a33234aa0927211049fbb3c666096ce76265b318ecaba
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                YEUk.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\YEUk.exe
                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                • SHA256 a731a46646e31b972c54eebcf9d10c32b03483588471952be6873c7e683504ee
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                YEco.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\YEco.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 43ddd6110dfcb580ea3321018ade39345c158935f6163b2bf592fbb3aee5b645
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                YMQQ.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\YMQQ.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 75c6ec8278aaabfaf66eafe090d1b8a8e741df283149343c125470640592ce0e
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                YQIC.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\YQIC.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 b5ed4328deb69ea6e8d6ffb8f22015bd7664ebd42693531aa3b8e5134e775915
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                YUsI.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\YUsI.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 bcc2217a4bf5d904aa877575db83f2f05c6e648534506efa677e3109cb5d72b1
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                YgUU.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\YgUU.exe
                                                                                                                                                                                • Size 3.5MB
                                                                                                                                                                                • SHA256 8fac9b1b51b0d67ddb6299257371232d5ec8b7589b253ac95967c9396009807f
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                YoAy.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\YoAy.exe
                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                • SHA256 5b1d70ed6a4dc5d334703cebd057b409fb63f743048f0e7046882a3d48d89607
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                Yoww.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\Yoww.exe
                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                • SHA256 d1f0b31038310198e4f30e7ee3df2abe5420563342b110154601872ecc12c62e
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                YsQI.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\YsQI.exe
                                                                                                                                                                                • Size 2.1MB
                                                                                                                                                                                • SHA256 e2423ee7464beb0e735055ec2834d700d496c8a79833710855c57cda27373f44
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                aAMM.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\aAMM.exe
                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                • SHA256 e527f131b7d9876ac18a95a4925d57111525847c13d29b24a2c3554eb93ca359
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                aMUs.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\aMUs.exe
                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                • SHA256 fd17f1927cb113853c4e7d68f9d379a3d6783a4fc3f570445807fc15249e4295
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                aUcq.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\aUcq.exe
                                                                                                                                                                                • Size 3.3MB
                                                                                                                                                                                • SHA256 8f5291a072801adf1cf03546e84552dbb6ef46d769aec3a5c51c2e6fecec2669
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                acMo.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\acMo.exe
                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                • SHA256 b92eae925e7ea3c3d23f0444a6e3d7abc676c619c2f1a41eee4de03a81638a06
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                ackO.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\ackO.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 0030ec1648abe6d94eba2b04184fc3f4f52b03682863056f04c9287b8a9c940b
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                agAG.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\agAG.exe
                                                                                                                                                                                • Size 2.1MB
                                                                                                                                                                                • SHA256 45ce145d062c30f31a7a1649b8c0eb36b559b6ad70018dd980032c173cf56222
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                agAS.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\agAS.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 6e4ef1f0940fa5eb84289d616bb8e5dc3291d039d05eccac930c17c8b37ac60a
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                akIQ.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\akIQ.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 9710339ce2164d1834d376ce9d63664de53b9ce3a5931b470bf6e526abad1e0a
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                akMU.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\akMU.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 fd73cdcc648b91d39d007842788b0e11831fe20b4b5f02e7b5ebdfe6005acab9
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                akoO.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\akoO.exe
                                                                                                                                                                                • Size 2.9MB
                                                                                                                                                                                • SHA256 ec150036797b680aacf5a6a0ff8f2f92c946afd52797c6257016afa5c02ec674
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                cIkg.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\cIkg.exe
                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                • SHA256 9dbffad50cb2a06cf3dfc689466ffc68cedbf6d84832f0321548771d15909e6b
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                cYgi.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\cYgi.exe
                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                • SHA256 650ae86055ae679dc9262ece34abd6aa85189a44fd882d4b65338376f585fedf
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                ckEa.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\ckEa.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 de6601ddb207a2136831a9f72b6a36c6a550a231b8273a6e2121b251c8d10a0e
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                coMi.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\coMi.exe
                                                                                                                                                                                • Size 2.2MB
                                                                                                                                                                                • SHA256 98b699d9fd4223b2497bd8072f4004e4c7ccd58b03c35c10887c99ded18eade0
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                cwMs.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\cwMs.exe
                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                • SHA256 875f1d78969a704707f61de88f5191ccdf7036460bc513efa84ac3baa744d220
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                eAIm.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\eAIm.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 c55e40412de47cafdc2f2a7d453cff5b61c4750c83b42c4f706d8ab1d57d01f8
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                eEYG.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\eEYG.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 10ebfb684f6a62f534c703383648d270e2f967c03e63acb356a03fd3f4fe8c35
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                eMIS.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\eMIS.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 7267deeb63fdcfe14e9fc0ef7256a18cd81cfc70d5d383f65589b25a5bd478ea
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                eMQC.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\eMQC.exe
                                                                                                                                                                                • Size 2.5MB
                                                                                                                                                                                • SHA256 2d6c63018d25a847ffa2b27173e2cdf5633595d74374b858c03fda810252be71
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                eUku.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\eUku.exe
                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                • SHA256 1ed35ac0bb9ce57109b6dbeed762e812ecb9de0f35da90f49c16bfcb757542da
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                eYAA.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\eYAA.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 8b0e1caa2b8790085279c0f8e3bb5b8f9583a107edf62fa9083ba4c5a9871973
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                ecgW.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\ecgW.exe
                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                • SHA256 e0d249500b3a74b2d45ac3e7cd3ff9220679a81f9ea828ce6538fc5c26634b93
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                ekAc.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\ekAc.exe
                                                                                                                                                                                • Size 2.2MB
                                                                                                                                                                                • SHA256 79c36f84a8b11895f232f838ddf7f401e174a7230a3e6785d166755832c62988
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                esAk.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\esAk.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 056f935cec84718fb2bc1ed041be0e2e6ff88d1fca7f906121d005b379effff5
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                gEYy.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\gEYy.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 abf0b3bf3fbfc387f69b73db2928ff5728b1c89b8ca9a8eb775965a23e2a75c2
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                gIka.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\gIka.exe
                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                • SHA256 514ac1d5f419d02b687ded85cde735c639b30b996c5917b904a790ca4bc38db1
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                gIso.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\gIso.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 f86d5ae7cfd27490e82b1299325b40ca81c9b4b459489238e1e139e48db3fe3c
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                gMMa.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\gMMa.exe
                                                                                                                                                                                • Size 2.4MB
                                                                                                                                                                                • SHA256 fa9ac801b62e46f1abc02efd89fb318772d782bcb3e3b3f89f78ea53848010d1
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                gYAM.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\gYAM.exe
                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                • SHA256 03dfb510ed0db021fc2054f7820ea85e1c326613ca0073b0a269f0fff45d82eb
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                gcUM.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\gcUM.exe
                                                                                                                                                                                • Size 2.2MB
                                                                                                                                                                                • SHA256 945e6d7891eff9e551401aa863bea1de6b8abc361ea4f4b3addb5ee3ac29e913
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                gwMA.ico
                                                                                                                                                                                • Path C:\Windows\SysWOW64\gwMA.ico
                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                • SHA256 bc4ed7d844af9da0a5d2fe12e8db07fbfdf6e0ecd557223b292bd0e9cb6a64a1
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                iMQC.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\iMQC.exe
                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                • SHA256 233e4d6b4bef35d4c05af8ee3a0c77329add0beaff6964f7875d295dd0186f46
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                iMQI.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\iMQI.exe
                                                                                                                                                                                • Size 2.3MB
                                                                                                                                                                                • SHA256 cd40964b7d73d2fa2ed58650cc72ddc3bb88cd99cffa8bf787a91c52184400fa
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                igkg.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\igkg.exe
                                                                                                                                                                                • Size 2.2MB
                                                                                                                                                                                • SHA256 4775bc376edc8dfa9dbba0c0d9aae5fc7b310f67ec3c6b8c32835ad0371951e8
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                imEw.ico
                                                                                                                                                                                • Path C:\Windows\SysWOW64\imEw.ico
                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                kwAS.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\kwAS.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 9e68ed87a39c1d70465d664e264676d26f9cf8d3f9d0835dcd1cc367accfdd18
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                kyII.ico
                                                                                                                                                                                • Path C:\Windows\SysWOW64\kyII.ico
                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                • SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                mAwa.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\mAwa.exe
                                                                                                                                                                                • Size 2.2MB
                                                                                                                                                                                • SHA256 b5dd6d63d36d13105fc35ac9f1baf25739bbd2d8f71872a8c31d489ba42e1034
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                mYQI.ico
                                                                                                                                                                                • Path C:\Windows\SysWOW64\mYQI.ico
                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                mgMI.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\mgMI.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 f7e7c8c233fb4427cd3789fc5fc62d4ad3cae4fa5be8a85f387b09d7a9644f7c
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                mgUI.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\mgUI.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 7df2beb314b5077c89df04440635fa9482a654acc1ce6af17b59f9ae6b4d7e77
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                mooM.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\mooM.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 e56c3d2a9ad5d9d9b4f287901755c888d7fe5ad60621248566588d0ab5150a0b
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                mwgQ.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\mwgQ.exe
                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                • SHA256 a27a8eb1edeb0faa97634faa06db1258e1228579867a7a8fc2a34b0580aa8c85
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                oAki.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\oAki.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 72a4818a72083406d0b65764be0cd71724e837fa293ef56c36232f82a296e486
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                oEAM.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\oEAM.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 80ec2532b00e4c2d8d4558af7144ad10446efed2fe93d504061fefd7fa85b03f
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                oMEC.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\oMEC.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 15d76bef43f987e181528a1589d6f338b52e61c45661d3ea62d6d04ed2467f2f
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                oMsC.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\oMsC.exe
                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                • SHA256 ce78400890b0b0e46ead4a6069ad1eb075e21457422787b3e0e9fbb96223e366
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                oQso.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\oQso.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 89b370472c69cd91022cbbee044ebb0b838f4e73d1595218ccf4c938f8ccefa0
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                oYAE.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\oYAE.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 c6356ae3e1b82421a5a3776f196ff273fbb17cadd8fffa3b020b31b71c6f8ba0
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                okAy.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\okAy.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 d7da536ceb2df27ab591c222d0ad762442ff3eda04ef885fedfb840a9f60eef1
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                qEYW.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\qEYW.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 1b7e79ebd12e56341ee48435464ad389d113586bae650fa178983f7c9d1b93b6
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                qcgY.ico
                                                                                                                                                                                • Path C:\Windows\SysWOW64\qcgY.ico
                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                qgoA.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\qgoA.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 3c62fef8f03867166bfadf11e6ae5d63a50235862da80323c5a7427c8e9c4e40
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                qkAu.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\qkAu.exe
                                                                                                                                                                                • Size 2.6MB
                                                                                                                                                                                • SHA256 4fbacca6f05c7683999cc783033e0f5ba7e99dd11305ea862f2aecc3c4dafc57
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                sEAI.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\sEAI.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 f7d1808126fcd061c2e4fded50d4dde6889b3e5b41a876b216a7b399e82317de
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                sEoG.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\sEoG.exe
                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                • SHA256 dbc3e91cd69fbd50068cadfe0ad740ca83aee2b4906a1ca5195c4d32c32dc6b7
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                sYQo.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\sYQo.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 18af20173c9b095764724b87a6cb1b9003d776db8dac5de13e6f5440a20d4c39
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                sYwo.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\sYwo.exe
                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                • SHA256 9bb4a7efe6e3943f08e352bdffb3897b535b7689a95ea63edb3207d0e59c9604
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                skIO.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\skIO.exe
                                                                                                                                                                                • Size 2.1MB
                                                                                                                                                                                • SHA256 6d6d0a1cb724a9657c14c94325f28bf3143c93313ac35880968dd35ac0fe9fd6
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                ssEW.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\ssEW.exe
                                                                                                                                                                                • Size 3.1MB
                                                                                                                                                                                • SHA256 c7a0bd68562862d9b941497681a7ec683583aa9946157174bad29e59bc98b7a7
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                ssYC.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\ssYC.exe
                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                • SHA256 fa25602064f78b996978db3d298685e963dcef8fce6d13d6eff04cad0f3e7473
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                sssu.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\sssu.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 753eedc173e84cac3e42511848376e4d1cd839a75afe1dad8b1822da6b6bede3
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                swYS.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\swYS.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 a33ba67aac9403937e68a02491d66df68c524e5584a52ba4cc24d4aca2847df2
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                uEEa.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\uEEa.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 4bc69eb2d98171ba551943e51895d5ef281f2dddc02fb9dac2f3357af0e35542
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                uEce.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\uEce.exe
                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                • SHA256 5e32633649440f0b4bb3641260be8c7ff4ba333baa22f8222980d0990f02bc28
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                uMAC.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\uMAC.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 ac52465a4d08c9d7620fa50759fa43c41fef1e65c7632315c86f74ab19a0b85b
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                uYEk.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\uYEk.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 35c16b9632d916761cb6884cbe71b3adfc64db69386e955d7475065fe3e123ed
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                uYEk.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\uYEk.exe
                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                • SHA256 b17ce5519f510b82693c659b38f3254d16ccb38d488c3f198b7fb769749c9891
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                ucso.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\ucso.exe
                                                                                                                                                                                • Size 2.2MB
                                                                                                                                                                                • SHA256 d34d016162a4f224885a1d90eab23a221576b42e11fcd475b5a4a4339043b75b
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                wAEO.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\wAEO.exe
                                                                                                                                                                                • Size 2.6MB
                                                                                                                                                                                • SHA256 86d5c7824c61d86b2e607a6b2ebd877cc68343cd5a0cbf93ca4e97cc3c36904e
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                wAMS.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\wAMS.exe
                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                • SHA256 0802fbeeb4bff370387e0d8a6e603e99acb99e8eb8290511f8ceb4c2a6fddfe5
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                wIQk.ico
                                                                                                                                                                                • Path C:\Windows\SysWOW64\wIQk.ico
                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                wMoM.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\wMoM.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 bcfa52587dae18cf69d3a05d0b8628b08ffa791afaf228ec57878cdd0f143ff0
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                wUIc.ico
                                                                                                                                                                                • Path C:\Windows\SysWOW64\wUIc.ico
                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                • SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                wYAo.ico
                                                                                                                                                                                • Path C:\Windows\SysWOW64\wYAo.ico
                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                wcci.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\wcci.exe
                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                • SHA256 cdea414ddd39074bd5ba5a9b0c071b9f1b2f7eb59b272032511f87caec4fbd64
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                weMg.ico
                                                                                                                                                                                • Path C:\Windows\SysWOW64\weMg.ico
                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                wgsO.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\wgsO.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 e7cd4eff76aecd944da8d63502386f51b5b4c5216c0a9dddf12323482cd163c4
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                wsIY.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\wsIY.exe
                                                                                                                                                                                • Size 2.2MB
                                                                                                                                                                                • SHA256 9fd7e65c4dfebf90080ae85fe061fb7aeca6fe55c4842fd49d06ee6d4da9af6e
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                wssK.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\wssK.exe
                                                                                                                                                                                • Size 2.1MB
                                                                                                                                                                                • SHA256 fa219b4ec714a0eb1d6996ac337d570526a561b6ef866e249cf9c63cb14b2387
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                wswE.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\wswE.exe
                                                                                                                                                                                • Size 1.8MB
                                                                                                                                                                                • SHA256 8244dd517b1412b6e618ba42ee02e383bda36305f198cb4b26b7a38a24e21c98
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                yEQw.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\yEQw.exe
                                                                                                                                                                                • Size 3.2MB
                                                                                                                                                                                • SHA256 0960859b4dbd8fd1fc1bc6d82ca482e2db2d59628f89cb378b9b7f21a851680c
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                yUoe.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\yUoe.exe
                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                • SHA256 c1032948165cf493a384d6f8b68c869a79a9254f5fdd8a8f0d79e8c2ec65276b
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                yoco.exe
                                                                                                                                                                                • Path C:\Windows\SysWOW64\yoco.exe
                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                • SHA256 94ca1f940829704c346c140535b87085952c7deeb7fcd584b5cdb2eaa64d1246
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                memory/240-218-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/252-267-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1088-493-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1088-439-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1168-550-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1240-379-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1360-805-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1896-883-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/2012-97-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/2268-280-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/2644-209-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/2644-226-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/2656-2461-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/2696-125-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/2740-42-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/2784-2466-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/2788-236-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/2892-174-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3092-186-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3216-199-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3400-0-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3400-1-0x0000000000790000-0x00000000007B0000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3400-30-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3400-31-0x0000000000790000-0x00000000007B0000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3516-249-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3540-2448-0x0000000000400000-0x000000000058F000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3540-19-0x0000000000400000-0x000000000058F000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3552-65-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3740-140-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3800-7-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3800-2434-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4016-1351-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4044-77-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4048-109-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4352-2150-0x0000024303A40000-0x0000024303B40000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4352-2166-0x00000243039C0000-0x00000243039E0000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4352-2130-0x000002430CDD0000-0x000002430CED0000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4352-2132-0x000002430CDD0000-0x000002430CED0000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4352-2148-0x0000024303600000-0x0000024303620000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4352-2131-0x000002430CDD0000-0x000002430CED0000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4352-2178-0x0000024303E40000-0x0000024303E60000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4448-1135-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4448-1049-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5100-723-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5412-300-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5512-592-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5544-153-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5548-997-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5844-16-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5844-2443-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/6072-258-0x0000000000400000-0x00000000005B1000-memory.dmp
                                                                                                                                                                                Download