Overview

overview

10

Static

static

3

2026-07-31...ck.exe

windows10-2004-x64

10

2026-07-31...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    31/07/2026, 19:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
  • Size 1.6MB
  • Sample260731-x755jsfm21
  • SHA256 abfbe6646e021c88dc153791b8c317207e879f9c524c4b6a519f2dc0126ebb86
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 64 IoCs
    defense_evasiontrojan
  • Renames multiple (113) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Drops file in System32 directory 6 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 64 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1828
    • C:\Users\Admin\wYIwMYUc\YmcUgwYE.exe
      "C:\Users\Admin\wYIwMYUc\YmcUgwYE.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of FindShellTrayWindow
      PID:4604
    • C:\ProgramData\UaAMsYAA\syQsowoE.exe
      "C:\ProgramData\UaAMsYAA\syQsowoE.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:4712
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3292
      • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:704
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2260
          • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5760
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2472
              • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3092
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1236
                  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:2376
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3148
                      • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:5424
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5688
                          • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:5064
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2660
                              • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:4136
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4148
                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:3492
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4524
                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                        19⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1548
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                          20⤵
                                            PID:3500
                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                              C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                              21⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5384
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                22⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:3620
                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                  23⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:5756
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                    24⤵
                                                    • Executes a command shell one-liner
                                                    PID:4480
                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                      25⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:6104
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                        26⤵
                                                        • Executes a command shell one-liner
                                                        PID:1312
                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                          27⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:3260
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                            28⤵
                                                            • Executes a command shell one-liner
                                                            PID:4964
                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                              29⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:4032
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                30⤵
                                                                  PID:5716
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                    31⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:1428
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                      32⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:6136
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                        33⤵
                                                                          PID:3804
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                            34⤵
                                                                            • Executes a command shell one-liner
                                                                            PID:6084
                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                              35⤵
                                                                                PID:5164
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                  36⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:3212
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                    37⤵
                                                                                      PID:1204
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                        38⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:5768
                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                          39⤵
                                                                                            PID:1244
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                              40⤵
                                                                                              • Executes a command shell one-liner
                                                                                              PID:5016
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                41⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:6112
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                  42⤵
                                                                                                    PID:552
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                      43⤵
                                                                                                        PID:4756
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                          44⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          PID:5200
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                            45⤵
                                                                                                              PID:1956
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                46⤵
                                                                                                                  PID:4752
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                    47⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:5012
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                      48⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      PID:444
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                        49⤵
                                                                                                                          PID:2756
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                            50⤵
                                                                                                                            • Executes a command shell one-liner
                                                                                                                            PID:5288
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                              51⤵
                                                                                                                                PID:768
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                  52⤵
                                                                                                                                    PID:3020
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                      53⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:2256
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                        54⤵
                                                                                                                                          PID:4836
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                            55⤵
                                                                                                                                              PID:2484
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                56⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:3448
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                  57⤵
                                                                                                                                                    PID:5172
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                      58⤵
                                                                                                                                                        PID:4348
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                          59⤵
                                                                                                                                                            PID:952
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                              60⤵
                                                                                                                                                                PID:2452
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                  61⤵
                                                                                                                                                                    PID:5580
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                      62⤵
                                                                                                                                                                        PID:3352
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                          63⤵
                                                                                                                                                                            PID:4684
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                              64⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:5148
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                65⤵
                                                                                                                                                                                  PID:1100
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                    66⤵
                                                                                                                                                                                      PID:5232
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                        67⤵
                                                                                                                                                                                          PID:5556
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                            68⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:4644
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                              69⤵
                                                                                                                                                                                                PID:2392
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:4956
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                    71⤵
                                                                                                                                                                                                      PID:3328
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                        72⤵
                                                                                                                                                                                                          PID:1916
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                            73⤵
                                                                                                                                                                                                              PID:408
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                74⤵
                                                                                                                                                                                                                  PID:3316
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                    75⤵
                                                                                                                                                                                                                      PID:5648
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        PID:1804
                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                          77⤵
                                                                                                                                                                                                                            PID:2912
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                            77⤵
                                                                                                                                                                                                                              PID:1376
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                78⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:3908
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                  79⤵
                                                                                                                                                                                                                                    PID:3636
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                      80⤵
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:5432
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                        81⤵
                                                                                                                                                                                                                                          PID:4660
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                              PID:5960
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                83⤵
                                                                                                                                                                                                                                                  PID:3436
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    PID:2532
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                      85⤵
                                                                                                                                                                                                                                                        PID:5344
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                          86⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:4652
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                            87⤵
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:6024
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                              88⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:2396
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                89⤵
                                                                                                                                                                                                                                                                  PID:2872
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    PID:5220
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                                                                                        PID:4068
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                                                                                            PID:5240
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                                                                                                PID:2168
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                  94⤵
                                                                                                                                                                                                                                                                                    PID:5216
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                                                                                                        PID:4680
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          PID:520
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                                                                                              PID:1516
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                PID:2636
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                                                                                                    PID:5824
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                                                                                                        PID:6020
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                                                                                                            PID:404
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                                                                                                              PID:4340
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                PID:4120
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                                                                                                    PID:4380
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                                                                                                        PID:4144
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                                                                                                                            PID:4352
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:6096
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                                                                                                                  PID:4248
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                      PID:5496
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                                                                                                          PID:4804
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            PID:4664
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                                                                                                                                PID:2040
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5152
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3680
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:3344
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5456
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:5724
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5944
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:5552
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5748
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:4408
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4776
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:4268
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:5740
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4412
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4368
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:3364
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5548
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3828
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3968
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:392
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                      133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4708
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5364
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1964
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                                135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2120
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                      137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:780
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1876
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:576
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4948
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1184
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4124
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4908
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dOkkQkEc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2108
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3116
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5204
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3892
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2584
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2084
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3712
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3744
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xAAgIAwg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3920
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6092
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5576
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5108
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Mugowkkc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5852
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1532
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1920
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YwQwQIwk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1272
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:644
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5492
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5252
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5992
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\omsgMUEM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5712
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5720
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2064
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2340
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3116
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hSwIQkUM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3240
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1876
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5980
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2084
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3712
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XoskAsAE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1000
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3100
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5796
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rWYMsUIc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                        121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1712
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2356
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3828
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2580
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tkQEEUIY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3764
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1444
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5840
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1124
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6036
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5296
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GAkkQEQM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1208
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6056
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5364
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5708
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\scUIwwYI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4772
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3784
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1148
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IuccIscI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4868
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3884
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3788
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2316
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3872
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1740
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aeAAMAYo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1704
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4908
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2288
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5752
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VeIEcAIc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3236
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5592
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1896
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4440
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5252
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RQosYsYk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3516
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3264
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2640
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5708
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3128
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3240
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZkMAIYwU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5336
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:544
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1716
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1580
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KOAMIQwA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2588
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5284
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1768
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5108
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2552
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uoswskEY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3940
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5300
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:100
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5736
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3716
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SKEccwsA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2080
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2040
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5492
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YsQwcIYs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4364
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:456
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5356
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xoksscMI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2592
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4084
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6064
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1964
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5464
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hWQoAUIU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2056
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5248
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3904
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bKYoQIsE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5672
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1076
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                              88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4384
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                              88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5300
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:416
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UuckIoQk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:564
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4736
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                              86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3760
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                              86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2580
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                  87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5228
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3236
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oukAUAEo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                    87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2040
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                              84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5704
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\quAoAQcs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:752
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                  85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5244
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1480
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PyQQUsAk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4440
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                        80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5112
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                            81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3112
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5328
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VIMsMUUs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:228
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                  81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4124
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                            78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5776
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                            78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5656
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                            78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cioQoIUs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                            78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6032
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5300
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2148
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\icoYAUEU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:216
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4144
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1292
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5228
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                      75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3372
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kEgQoYoA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4472
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5160
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                      73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1832
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5204
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                        73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1544
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BioEwMcQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                        72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5136
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                            73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4652
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4432
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5548
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TIEQkcgM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1296
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2212
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5968
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2056
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MOAYoUQM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5212
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4656
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2464
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3684
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GekkMcMY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3860
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4688
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              64⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2040
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wkMcEAYw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3208
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3908
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1000
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4244
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AcAcAsow.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4020
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  63⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            60⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2068
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            60⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              60⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4688
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HAEkwAIY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4132
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            58⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3264
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            58⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1704
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              58⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mwIcoQEc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              58⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                59⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5396
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  59⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            56⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5652
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            56⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              56⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2112
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fosUAQoE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              56⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5680
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                57⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5068
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          54⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                          54⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:568
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                            54⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3904
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yCoYEgoI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                            54⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4396
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                55⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                PID:228
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          52⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                          52⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4364
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1740
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qiscgQEc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2364
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                53⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1724
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          50⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                          PID:576
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                          50⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5712
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                          50⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                            51⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XCcgMcEQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                            50⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5392
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                51⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          48⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2084
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                          48⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                          PID:780
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                          48⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\waMsAQoc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                          48⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2880
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                            49⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1076
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5488
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:228
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                        46⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5112
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rSIIEAIE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                        46⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1012
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                          47⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2044
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                    44⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4592
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    44⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4576
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      44⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1444
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SQgwcMcE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      44⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                        45⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                  42⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1148
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                  42⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                  42⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2940
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XKEgQUwc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                  42⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:808
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                      43⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2364
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                40⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                PID:1484
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                40⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3028
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                  40⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\teokQwkA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                  40⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5820
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                    41⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3940
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                              38⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:5324
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                              38⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:4412
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                              38⤵
                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:3272
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oagsIggw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                              38⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4448
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  39⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  PID:6020
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            36⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            PID:456
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            36⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:1208
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            36⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            PID:6036
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hqIgMoks.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            36⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:3736
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                37⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                PID:3112
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                          34⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          PID:4968
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                          34⤵
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:5620
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                          34⤵
                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                          PID:5900
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XGogsIIE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                          34⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          PID:5920
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                            35⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:5152
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                      32⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                      PID:5708
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                      32⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                      PID:2316
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                      32⤵
                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:2584
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JmUUEogI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                      32⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      PID:4040
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                        33⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                        PID:5528
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                  30⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:2536
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                  30⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5284
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                    30⤵
                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:5492
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SMkwcwoU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                    30⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1380
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                        31⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                        PID:1076
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                  28⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                  PID:3872
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                  28⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:404
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                    28⤵
                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                    PID:5316
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GsQwwQgo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                    28⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:1364
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                      29⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                      PID:1480
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                26⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                PID:2600
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                26⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:1684
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  26⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  PID:4200
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jWgIAMsY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                  26⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:3852
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                    27⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                    PID:5184
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              24⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              PID:2180
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                              24⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1132
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                24⤵
                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                PID:1920
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qmIUIwIw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                24⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:2804
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                  25⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                  PID:5396
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                            PID:3744
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                            PID:2588
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            PID:2356
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ywMwcQsU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5892
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                23⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                PID:3924
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:3696
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:2796
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                          PID:5752
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\igwwYYsk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:1156
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                              21⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                              PID:3908
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5836
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                          18⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4384
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            PID:2460
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xAUIoggw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2664
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                19⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                PID:2904
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                          PID:3516
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4328
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                            PID:4432
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JKscwwYg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                            PID:4580
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                              17⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:1544
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:5324
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:5096
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:3676
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QcYoIggc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                        PID:2740
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                          15⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4812
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                      PID:3736
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:6044
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5476
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cycAAMkY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                          PID:2320
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                            PID:2536
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4804
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2552
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                          PID:4360
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CuMoQsQc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                          PID:4916
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:808
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                      PID:5296
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5772
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                        PID:2940
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zgQgMMYg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                        PID:3424
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                          PID:5400
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                    PID:6140
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:3352
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                      PID:2464
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\toEYgckA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                      PID:4532
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2180
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:1504
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                    PID:2560
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                    PID:3244
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CWQYAoMk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                    PID:1432
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                      PID:2588
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                PID:556
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                PID:6092
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                PID:1048
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vwIckIkM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                PID:2528
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                  PID:1616
                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\ccgkQwwc\XmAMMkAU.exe
                                                                                                                                                                                                                                                                                                                                                              C:\ProgramData\ccgkQwwc\XmAMMkAU.exe
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                              PID:3948
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\wYIwMYUc\YmcUgwYE.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\wYIwMYUc\YmcUgwYE.exe
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                              PID:1612
                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\UaAMsYAA\syQsowoE.exe
                                                                                                                                                                                                                                                                                                                                                              C:\ProgramData\UaAMsYAA\syQsowoE.exe
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                              PID:708
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1768
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1832

                                                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                      Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                      Resource Development

                                                                                                                                                                                                                                                                                                                                                                      Initial Access

                                                                                                                                                                                                                                                                                                                                                                      Execution

                                                                                                                                                                                                                                                                                                                                                                      Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                      T1059

                                                                                                                                                                                                                                                                                                                                                                      Visual Basic

                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                      T1059.005

                                                                                                                                                                                                                                                                                                                                                                      Windows Command Shell

                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                      T1059.003

                                                                                                                                                                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                      Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                      T1548

                                                                                                                                                                                                                                                                                                                                                                      Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                      T1548.002

                                                                                                                                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                      Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                      T1548

                                                                                                                                                                                                                                                                                                                                                                      Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                      T1548.002

                                                                                                                                                                                                                                                                                                                                                                      Hide Artifacts

                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                      T1564

                                                                                                                                                                                                                                                                                                                                                                      Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                      T1564.001

                                                                                                                                                                                                                                                                                                                                                                      Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                      T1562

                                                                                                                                                                                                                                                                                                                                                                      Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                      T1562.001

                                                                                                                                                                                                                                                                                                                                                                      Modify Registry

                                                                                                                                                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                                                                                                                                                      T1112

                                                                                                                                                                                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                                                                                                                                                                                      Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                      T1555

                                                                                                                                                                                                                                                                                                                                                                      Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                      T1555.003

                                                                                                                                                                                                                                                                                                                                                                      Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                      T1552

                                                                                                                                                                                                                                                                                                                                                                      Credentials In Files

                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                      T1552.001

                                                                                                                                                                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                      T1012

                                                                                                                                                                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                                                                                                                                                                      System Location Discovery

                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                      T1614

                                                                                                                                                                                                                                                                                                                                                                      System Language Discovery

                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                      T1614.001

                                                                                                                                                                                                                                                                                                                                                                      Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                      Collection

                                                                                                                                                                                                                                                                                                                                                                      Data from Local System

                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                      T1005

                                                                                                                                                                                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                                                                                                                                                                                      Exfiltration

                                                                                                                                                                                                                                                                                                                                                                      Impact

                                                                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                                                                                      syQsowoE.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\UaAMsYAA\syQsowoE.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 2242e0ed07703694b6872259e37f01075ad8f29916ee5ce67c99c7af538b56be
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      syQsowoE.inf
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\UaAMsYAA\syQsowoE.inf
                                                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 00c0454b520627311b190f76dc62433261b1572f50a14ffc9d85e7e71565372f
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      syQsowoE.inf
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\UaAMsYAA\syQsowoE.inf
                                                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 08393955e9db2d8e3df64ba223e3ea45771ef93188c471d8a6df2d7e1f2831ef
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      syQsowoE.inf
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\UaAMsYAA\syQsowoE.inf
                                                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 3f7591d2cd0aeb120169b50487db87d889d4957a6296b6783d6eab89ed8a5c8b
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      syQsowoE.inf
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\UaAMsYAA\syQsowoE.inf
                                                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 9c395af9d8d41bb837e4f584084b23c30f4d2a2c5da1cf9e4557928b578a052d
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      XmAMMkAU.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\ccgkQwwc\XmAMMkAU.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 adba8801c81747486cb936b9acf379925536e75afd195030a9e9b4460ea621e5
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      qWwI.txt
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\qWwI.txt
                                                                                                                                                                                                                                                                                                                                                                      • Size 10KB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 37d929b189f51d7c55575daa0c6d68c6553fbb0c9679acee29401c5388c8994f
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      tinytile.png.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 313808c7d726b1736ff54f89ea9bc6e4408738b9ecb9b5ce77551496e0d956f5
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-07-31_02c0c15fdc05fc0134f0c4033b524ee6_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 7d4cb603017c3703ff18e7c015375f87a8f130b65338bd31ef81caf8f7b8628a
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      AMEa.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\AMEa.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 fffcbd3ce23c6487b852b8827974f699bf4000f14a62a1e2035b72510945d0ba
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      AQEY.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\AQEY.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a0a52898e29d95dc1c910e4169b59839e3cefd17b7d3b0318ae220bd2015139f
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      AUYQ.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\AUYQ.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.7MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 3187b22440aadfd184a87c20f0822387103329d6fe1c2c14e80fb7114d131c47
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      AoYK.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\AoYK.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 228547f7b44958ced1a7b4ad6817ac7b00b07f5dbf26990aa2c1cc2e163bcdc8
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      CIYU.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CIYU.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 3.1MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 688d0bf5f4c43226ad2b35404e147b969047ce36583296fabedfa62773a8ad59
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      CQQK.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CQQK.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 82db1cbadedede5d6a5ef04bb4c9b5120177cbde0fd5c6146e959c276853f10b
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      CQUk.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CQUk.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 cb0f944316b75dfec8974f663fb9da2930d61d867628d9435d19df5a022ad1c7
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      CoQI.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CoQI.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ae18bd0aa6739227586ff9894ca7eea7db95846a253d23ac8b123bc53b933652
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      CsMa.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CsMa.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 b2edb817d0fd2a34feb8bb81b1f5e2c433fffa3ea74aa7fdd98d9e7c8e79b912
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      EIAA.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\EIAA.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.5MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 2e7ee8a3ae0fa261441ce74358755780bd43a5804d182f925afe25b373c597aa
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      EIYw.ico
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\EIYw.ico
                                                                                                                                                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 684e75b6fdb9a7203e03c630a66a3710ace32aa78581311ba38e3f26737feae6
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      GEse.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\GEse.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ca0bf68cb1a1fe7c73684b4d223e9772169c05b8a457534a31bce73272462d7f
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      GMAs.ico
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\GMAs.ico
                                                                                                                                                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      GcUa.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\GcUa.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 cb901f78dee5a306547ac644187133aa2543d9522f087c602baaf359cdf2a3d1
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      GgEe.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\GgEe.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d5cb57a5c1a0ff77a786731ceda5c7e00278d83a127d5a2f803962c095fc8c9c
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      IAcM.ico
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\IAcM.ico
                                                                                                                                                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      IcQG.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\IcQG.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 5c79640c0a855c42e1d7b715aca5f7529cdd65d1aaa783f67a2e44fe724dd16b
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      Icwu.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Icwu.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 0f0adf47541a912b5a5420764d8abd61863d2fce2fe0cd644d48b3f4f26e89d3
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      IkEO.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\IkEO.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 6b91c189c218eee34cbd4f83e0e82b8dfbb501005cffeacb20b63f3736869cd1
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      IsMs.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\IsMs.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 2cf9e9d5367f1ac985ba39417408e43238cff69718baf970999c3a6f93dd0c94
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      KAQu.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\KAQu.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 aca3029378f05b3a881d2a63bcaa3a45c89d1e07ec26c65c31d62eda6b6332c8
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      KIAQ.ico
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\KIAQ.ico
                                                                                                                                                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 135efe6cdc9df0beb185988bd2d639db8a293dd89dcb7fc900e5ac839629c715
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      KUgC.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\KUgC.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 88c0c9b0a15033c1ecfc28f59663586a5745c8f4f5ceeaab9219fddfb746fc68
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      KcAo.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\KcAo.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 f496afa81f45f990ba0ed0979836384ba455aa280ffa7c08d86b04cd399a1606
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      MAkK.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\MAkK.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 f03e41fece323dd78127e2f0b7d89f0f78768a032a1dac16c0999be0468a58df
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      MAoM.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\MAoM.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d76d9aaec8392b5b9317499c753617b7ccb366dd34eaaf74b3b74d7f20fe7384
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      MEYS.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\MEYS.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 7b031b6ccfe89aa451be0ddf29dd6149dca6fa644da5e444ee7ff563b9c16ee1
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      MQEQ.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\MQEQ.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 5e137f856d1048e5593ec9c4230903ab1883afa6a21eb56ca96572527f2a9efb
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      Mwke.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Mwke.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 fac2fbcda153f765b05eb00cbfacb631f7b3fc9402489525be324d291fdf8246
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      OYsU.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\OYsU.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e4cb8175850630ad2b478eb93cabd84ba65dec1340ee4f51e5f6933929c51fce
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      OsYy.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\OsYy.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 991e368c6547a49f38973b74481ce0b31d792aba09b6663eaafb712fbb0d1768
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      QEkW.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\QEkW.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 5798c8ba62f8efb17d440e7021e04f7ba4b7c016e9fae33ac1d5446ea04de666
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      QIgA.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\QIgA.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 c133ad851ea20ae6f7d412524de7fe3a9b277d48a54ee43edbf131ea535e95b4
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      QQMg.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\QQMg.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 78bd6a782a57280119375242e3421d23c3f79192488295a0a755b4d099e9101f
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      QgUW.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\QgUW.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 c719b3d9a06cbcbccccd804892da0cbe8fc6d3eb23800c135ce52a07667276dc
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      QkIi.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\QkIi.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.5MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 2f81e6df1b007e20f5c722b347fae930c37399179dafee174b15c6e449847294
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      QkUC.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\QkUC.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 29bf81f7a67b15084ced49bf95b00374e6ea3d04ad2d5d47b7f71d01b35e1a11
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      QsUi.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\QsUi.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 cd1b2c970bc4c1feadbac059ec413093531944c0398ebe308ffcbe2300c3c71d
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      SEUq.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\SEUq.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ee0ca77ae0117aadb536a5655447812e029d0f2e95030c42c3e85009c15ccc57
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      SkUg.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\SkUg.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 467cdcbfe5800d0be5ecd7897586839142253ead4cfb2717aecc0439c2869c81
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      UAgY.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\UAgY.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 7532ac152ef6f6295d09d06f35373fca687145682849d53a1f53d8485d430d08
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      Uswm.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Uswm.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 eafc9df4e66282fa69211f58478fb5c22e9dfe39c733bffbc097517cf8a53a18
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      UwAk.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\UwAk.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 cfa093d6a5a07913afe9f09e76f6a753aa056a8cd236e474993fc8b7bc4efae3
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      Uwse.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Uwse.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 cde98ec85eab1ce3e95aabf6f5ee91e5fbaa96c427c22379b7443b0f73ef3cbb
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      WIwW.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\WIwW.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 57c9bb061c3da094a8abba487270f29f1ab073969b8fb2fafbb33377986be7a1
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      WMIQ.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\WMIQ.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 aa9df75c4bad68237419f14c3a1509b0b9f8e601eafe1dd980844d771dbd5f69
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      WMYa.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\WMYa.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 1a1966db66969cadd029bd6ad90743e75e25a8fdcb471446ef7cce96426ad419
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      WcYU.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\WcYU.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ac3c25e491fc2025018e02d6806a20ef635a3c1d1d05372addbec027bca35f08
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      WcsS.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\WcsS.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 7.3MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a06ce871ee4a801aecaa424f01eebcb2871b4acb7732a41bb57a1b5071111b46
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      WwQm.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\WwQm.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 0c55601afab9aac5742588b2aaeed6274df48cabefc06517e5dfe807abc1b580
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      YAgG.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\YAgG.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 3f73e719b83fb2ede5178fc78f888a03b0207523e1f3158c2c5b8669486c3222
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      YIoq.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\YIoq.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 22b6a7536f7229c8ccfe2f977e95210c7818dd12351fdebf5008c5d603e9d746
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      YQgK.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\YQgK.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 5f06b1938cd13986bcd2e3b657850d26f6afa0f611ef377184844b060b9246d6
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      YQwa.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\YQwa.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 332fb386b92e22422799890314e73253d0faa96c3b2cec2a3a24a73df5eadfbb
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      YkYS.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\YkYS.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 60b202b4bc126e1f3fe8e139c6d0d98b6a6d5dafe4cd2294efde04542fa661e8
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      YsAS.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\YsAS.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 262a993e09e79b9c99a8243b7408524f0fe90e92851f557a51d98b0f60b76bbb
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      Yswe.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Yswe.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 49110d87181e990205d842a3cb3b65d678ca407fac9b94e227b871e2b1eca514
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      aEMu.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\aEMu.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 f55db644c5feb5a8767bcc6f7b6f62bdde61a0bd71289ccf5144e4769f780930
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      aEsU.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\aEsU.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d41d1317705e018df6d6a545ca768f29dee2efdcff45201abb7408707d75b6da
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      aIcc.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\aIcc.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 0d14fe0c1f5617b974d0f1d7c0214fa5b1485a6a6639b6fd0fd7745baac0c21e
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      acYa.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\acYa.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ae96b6b560b876f17b03553eb5d64020c3f919a1c966601ca6ad72f53852eecf
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      aicQ.ico
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\aicQ.ico
                                                                                                                                                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 57e72b9591e318a17feb74efa1262e9222814ad872437094734295700f669563
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      cEYA.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\cEYA.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 292bc359acee2921960b4a321af103e0ea59276be834e84dfd4c49fdf6ccf70e
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      cIAM.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\cIAM.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 8c978fbae24d0d967b29e3595b5be37c3d56ddcfe40b1f81515a5cc66c25a660
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      cIUC.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\cIUC.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 20ff199ffd9cee2fcf87b67fb25f6ee09a48eca291c9d87fc834988ae3dfe232
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      cUIQ.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\cUIQ.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 0d7e01ee6e42a3390cfb937706efe42c4f0857a360d5c934471c362263197fe2
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      cYoq.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\cYoq.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 1d3fefab3be5039c079e43f8ec497df8606a6c39cd912c59adf1715ea83c481c
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      ccEG.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ccEG.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d81b68edc6e29811e4155949e3fec511a325044ef89a34867a0a0a773c1c5633
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      cgAG.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\cgAG.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 4c66df0345a65e483461acba124bd9b2b48489adb75e26789d334751a1763af8
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      ckAm.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ckAm.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 c48955deda98fafce82a8947c87fc2c3f1b0875521039b3bf4070b5766dbe736
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      ckso.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ckso.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e27a84660bf62661ff0b62ef743e027759b11c10e25ba012c8edaa94b02a4139
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      cwIo.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\cwIo.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 b934f266b703d7233d689dedf5731eb0d821704534d67f6ba8583e327fd6a65b
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      eEQc.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\eEQc.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 498a53c19616f8594c3ad10b6ec5d3164cb1e31d4c6b7e93f416393c494a514d
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      eQsg.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\eQsg.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a2de1b9b23402599faf4dc5a0ff78d3501ced042c5aef897cb98d2f58fd698cf
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      eUsa.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\eUsa.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 10845fbce514ebc158cde3634b27c39ef1fd266965a8c628f77ad6cb38e0cbfa
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      egoE.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\egoE.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d2acf272610b290188c44f30df53a52776be1effe1100a849e1f87cf94d838ec
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      ekQY.ico
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ekQY.ico
                                                                                                                                                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 0b945cd858463198a2319799f721202efb88f1b7273bc3726206f0bb272802f7
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      ekws.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ekws.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d08a66d590093bc0e2cb2322bd68f4885759b8af4be7f67dddc1d30d56a4a42f
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      eoEq.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\eoEq.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 64e647b057a2ff4147c81041d02c740040e1a822c1db4b3e51021cd593cfc3f0
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      esEq.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\esEq.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 7e00cbd09f41724e9209cf49ad2f97ebea30e3a07e9a720e14fc062f1c3a7410
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      ewEg.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ewEg.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 361598e5c4ecc59eaba36bd7c4fc4e6135a7ed14bacfc02182f708848a7a173c
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      ewUo.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ewUo.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 61b60fc65bda1ef3e540418dee417c880095c65b13774ac222bd39fd0b338191
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      ewoE.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ewoE.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 0af9f6296e0732ab4668a2c079b9475f56052140baac9f89d077bf18ecd4d81a
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      file.vbs
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                                                                                                                                                                                                                                                                                                      • Size 19B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      gMky.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\gMky.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 f1c65da014e374a0e187efcbcebcd079732b586ec3f3fa32c4a2ae050bbc0b50
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      gUMc.ico
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\gUMc.ico
                                                                                                                                                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      gUkq.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\gUkq.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 7d6f95b2d15f25b294a6c77880040436cd6cb98a2e5d3372e0e756a4dcffaad8
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      gsow.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\gsow.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e6f8d406401ba2f85a12fa8bd9d17a965cd79a97380c41c721f4a935b4a4b216
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      gssc.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\gssc.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 7afd0ce9ccf96aa55851a5bae15ce65bb744b49547a3d325c109ed84c69a605e
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      gwQi.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\gwQi.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 213fee4b1f3263be9c3bfbc14ac9127567bd6a296ed7c557fddf43ca6f8dbeed
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      gwcE.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\gwcE.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 207c53f1609bb8af10bb8ebaa248e22c682c12e1e6d4dd5079383a20a2b7017e
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      iEMC.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\iEMC.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 fe399066d6325553237fb52c1b0077d1811438ed7c60a283c503b57c3975823e
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      iEUY.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\iEUY.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 2d7d70ece0aba70c2473f9f40e98ccdb4c214dce1edf2b2a3b5585fa9afd7c4a
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      iQoC.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\iQoC.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 03f4cc8e25723b3b27e07baf9caad58bc3129c0717fe303d0a5036416e2898d2
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      icAW.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\icAW.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 7b35147e1e9660acdcca205680edf9681cff9c285ad75785b0e233ed3139cdcd
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      kAUk.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\kAUk.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d922c823f8c3f938c0b96768fc4baeb7b60be84fdbcf0d1937d2295201be2968
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      kEcE.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\kEcE.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 1400a96e2797efca3179194388592393959b7fcefc92d4574f991b0e217019c3
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      kMUi.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\kMUi.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d84033164c6dd4012e3a35abe928c8f227d38687dad812c26deb095e79e5d092
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      kgcA.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\kgcA.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 df51305e65929c6d32fac6602c038c1959bceb05953e0a1faa5769808bc7945f
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      kgga.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\kgga.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 52b5b2af3e2f797453fc7616bd0b9eeade01ff45cf7a7ee6a75edcd4cdd4cbb4
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      kogc.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\kogc.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 6ec1f5a901a86b6e0487f1863f98c66aa2ac368fefd2f82189d3db0b5e69ae38
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      kowe.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\kowe.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a2b23c615fd4b99ac74337f2bf532896de98260d94064710ea1235bcb902f7d4
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      mAko.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\mAko.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 00eeaab614368f19c5a39e7001b1cd26e6e63b4620981554e1ef76be64a29193
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      mUQk.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\mUQk.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 baea4cdfd0c29b72945797acdbb8a9c138516bb91baeff6924166fb6db2d23e6
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      mgIo.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\mgIo.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 7866544ece5e08941df6169bcf681fd58994c055594b8740b5edc6c8918fb1b2
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      mkwG.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\mkwG.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 be547c1da1974a7a482b0877d1bded6d62631c9a5d7012fa8914ce39d83a14f4
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      moog.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\moog.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 2ea092f054db7b11696e60b57681925858d0f225c079f2873f1d0606bb079930
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      oYMo.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\oYMo.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ef6d8ef44ed81500f7ce8116dccccdb210686804eefc1ed3f74dc7dccf6ab465
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      ockC.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ockC.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ab2b031c9eee6c2c85411d0978e415c003ea52dcd527c020036c3420bbc21353
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      ogso.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ogso.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 f9010fe0067512abd78fb2050cfb6f6454643615be6b5d314e134de2d0236508
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      ogwk.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ogwk.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 807f067800444696818e4a10672bf3d02b9b73978b3072ba1b0fb5c7d84c90eb
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      okAE.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\okAE.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 cc2b8aef64a620a82993a5370c88dec3d265ed9ff21e5f96110b7396bfb33da6
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      okQO.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\okQO.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 3f094ab049b913d500a1cc55e761e563792f8877f15a0629dfab1eade3527b75
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      oogs.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\oogs.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 2a111998c05be1f16dc4ef7cd7fb6274de79645a04838fbef796b137b7f53666
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      qEMQ.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\qEMQ.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 8ed24d79889c65a7846a93bd725d0b91c587a4bfd553cf45444f4cadaaed45f9
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      qMMo.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\qMMo.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 9f939c2b35db326f46a44c1b1f7035404c076830616197ad174ce0a8a0808208
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      qMgA.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\qMgA.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e57384fcd0783e2029235dd78c20ba340d481727b9f9f5d19442ff3598c0ed38
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      sEEA.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\sEEA.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 77dca715b89ac0ec6beb3ac98fb5d789662ae11284718a38c33919f77359958a
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      sMQw.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\sMQw.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 04c8bc2f251a95bcbd5786291ee0ad4db6fd4557ef5b9720abe11acfba1a6081
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      sUwy.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\sUwy.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 edd210122582e59d68674a0680ca43e5b54cc1f19f4ba8c86b3bbf4079041ea2
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      sccK.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\sccK.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 0a18b805a6b3b4b6a1e79d1a9c5a811b6865776d532881723c82b527ed588320
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      scoc.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoc.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 0ca4719e16701c85297524a79b908c2becb78441585dec43197ed459c7839c9c
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      sgUw.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\sgUw.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a6ca4a068ee7884c5173dc6bd09dd06934f99a767761ededaca836b30d2fa522
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      socI.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\socI.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 28ad3ff83c4d2f681986776d9c1f2393452b23fc53c2cc859d02302cc453ad74
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      uAsE.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\uAsE.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 88aa87c398099f0c3f8f1887c1b9b7fda84faaad725fcc5622db690ddd4d1e00
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      uIge.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\uIge.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 aaa2325ed9a36d1d48b0bbeee8fa821f5bf7b5c163bee555d753db5ff126ef7a
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      uIwe.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\uIwe.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 6c6de4327483c658c71f01e9fe0ed6a7069fd5f266b5a5a278ebbf8fbc122ea6
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      uMIs.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\uMIs.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 99faea198f7e78d4f487e1496ca3eaec39021ede3c0698b8064d5772d3028751
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      uMMc.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\uMMc.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 dfc12195380cfd92b808dd5435e7314352a6d476b9128a860afa0b89eca5bf40
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      uosU.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\uosU.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 c7ebaada64b09ec559e98e3b888fb2d70e4911e6aca00e2ed469c6cc567802f8
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      vwIckIkM.bat
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\vwIckIkM.bat
                                                                                                                                                                                                                                                                                                                                                                      • Size 112B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      wIUk.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\wIUk.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 94c453b24725378ec3bca07e5e384aac711f45bb899e76d0d4c600fcaadb420f
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      wMgk.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\wMgk.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 0ab6a11a0c833d542e12f9dc3f56c319fca6545317e5a5e87b6687ef9d9b413f
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      wQkI.ico
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\wQkI.ico
                                                                                                                                                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 daa05353be57bb7c4de23a63af8aac3f0c45fba8c1b40acac53e33240fbc25cd
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      wkco.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\wkco.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 2f157c28dff85b2e490ee2d970e9be84f745cab40e2cc515dfc7e9160cd3b97a
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      wkoq.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\wkoq.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 89e78ddd6e7b174c4475687a58a6297b3595ce40ee139cef10cde15246eee470
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      yIAK.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\yIAK.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 7e3be08c85e58aeaf639b5e570bd307ebec9ba140b940518dcca028937d9560b
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      yMUy.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\yMUy.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 90ba8b06012e62d3b09083602f734a1209ae490f44d6d120a6bdf8c27a0ac8bc
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      ykIe.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ykIe.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e5818b9634dd0239055b31160d51198a3d719486c53528444994431607e636e3
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      ysEY.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ysEY.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 81a3787d8890c2f11efd2f768d52fad0cd81b51d01d2cd7f1136c2a6c55bf179
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      BlockInitialize.wma.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\UnblockTest\BlockInitialize.wma.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 2.8MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 addcd388a062b2a416943e3285af416ba26218cc1136884b66ab88b612d38afb
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      YmcUgwYE.exe
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\wYIwMYUc\YmcUgwYE.exe
                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 39a3cc81b9c8cb3dcb2e57ed905fb7c2be9b004e7adfbc09623a65d8bbe6d2d7
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      YmcUgwYE.inf
                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\wYIwMYUc\YmcUgwYE.inf
                                                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                                                      • SHA256 f140d47f60800aad98def503beb70990033e57c0d693c5a3609692c7ecd66bb6
                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                      memory/408-2061-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/408-2073-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/704-28-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/704-40-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/708-42-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/768-1236-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/768-1285-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/952-1632-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/952-1574-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/1100-2032-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/1100-1925-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/1204-625-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/1204-561-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/1244-754-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/1244-685-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/1376-2081-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/1376-2088-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/1428-361-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/1428-289-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/1548-142-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/1548-160-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/1612-39-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/1828-27-0x0000000000930000-0x0000000000950000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/1828-0-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/1828-26-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/1828-1-0x0000000000930000-0x0000000000950000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/1956-1058-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/1956-1028-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/2168-2152-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/2256-1392-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/2256-1334-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/2376-73-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/2376-91-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/2392-2041-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/2392-2053-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/2484-1452-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/2484-1395-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/2756-1185-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/2756-1238-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/2872-2146-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/2872-2132-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/3092-72-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/3092-59-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/3260-229-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/3328-2060-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/3328-2050-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/3436-2108-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/3436-2120-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/3492-145-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/3636-2099-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/3804-387-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/3804-449-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/3948-19-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4032-235-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4032-226-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4068-2147-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4136-122-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4136-133-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4604-7-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4604-731-0x0000000004020000-0x0000000004040000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4604-217-0x0000000004020000-0x0000000004040000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4660-2100-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4660-2107-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4684-1860-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4684-1795-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4712-16-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4756-962-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/4756-887-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5012-1190-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5064-117-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5064-104-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5164-478-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5164-553-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5172-1537-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5172-1490-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5344-2127-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5344-2115-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5384-171-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5384-157-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5424-88-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5424-103-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5556-2040-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5556-2034-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5580-1725-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5580-1646-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5648-2070-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5648-2079-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5756-173-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5756-182-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5760-62-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/5760-52-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/6024-2135-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/6104-192-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/6104-203-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/6112-739-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                      memory/6112-828-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download