Overview

overview

10

Static

static

3

2026-08-04...ck.exe

windows10-2004-x64

10

2026-08-04...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 04:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
  • Size 769KB
  • Sample260804-fl86msgj4y
  • SHA256 ab104a2aac07f8058080cf95c907741ea935eb46a36bc76a6a45a5d39933c640
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 64 IoCs
    defense_evasiontrojan
  • Renames multiple (71) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 64 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5440
    • C:\Users\Admin\bmUIQYss\riogsAMk.exe
      "C:\Users\Admin\bmUIQYss\riogsAMk.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of FindShellTrayWindow
      PID:916
    • C:\ProgramData\oaAQMYsk\CasQgwkI.exe
      "C:\ProgramData\oaAQMYsk\CasQgwkI.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:704
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1816
      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4912
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:6000
          • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3284
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2948
              • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1312
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4196
                  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:3304
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3256
                      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:4388
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3556
                          • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                            13⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:2296
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:5640
                              • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:2384
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:5072
                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:1344
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:5828
                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                        19⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1460
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                          20⤵
                                            PID:3032
                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                              C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                              21⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:2264
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                22⤵
                                                • Executes a command shell one-liner
                                                • System Location Discovery: System Language Discovery
                                                PID:2924
                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                  23⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:1264
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                    24⤵
                                                      PID:1472
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                        25⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:2544
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                          26⤵
                                                            PID:4324
                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                              27⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:4540
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                28⤵
                                                                  PID:4768
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                    29⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:4856
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                      30⤵
                                                                        PID:1356
                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                          31⤵
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:5792
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                            32⤵
                                                                              PID:5912
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                33⤵
                                                                                  PID:3888
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                    34⤵
                                                                                    • Executes a command shell one-liner
                                                                                    PID:5732
                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                      35⤵
                                                                                        PID:2980
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                          36⤵
                                                                                          • Executes a command shell one-liner
                                                                                          PID:6076
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                            37⤵
                                                                                              PID:3184
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                38⤵
                                                                                                • Executes a command shell one-liner
                                                                                                PID:4304
                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                  39⤵
                                                                                                    PID:3664
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                      40⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      PID:4948
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                        41⤵
                                                                                                          PID:1444
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                            42⤵
                                                                                                            • Executes a command shell one-liner
                                                                                                            PID:4108
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                              43⤵
                                                                                                                PID:4200
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                  44⤵
                                                                                                                    PID:5472
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                      45⤵
                                                                                                                        PID:2484
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                          46⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:5648
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                            47⤵
                                                                                                                              PID:2456
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                48⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:2880
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                  49⤵
                                                                                                                                    PID:5052
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                      50⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:4184
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                        51⤵
                                                                                                                                          PID:5816
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                            52⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            PID:2316
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                              53⤵
                                                                                                                                                PID:3964
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                  54⤵
                                                                                                                                                    PID:1372
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                      55⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:4752
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                        56⤵
                                                                                                                                                          PID:4516
                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                            57⤵
                                                                                                                                                              PID:2888
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                              57⤵
                                                                                                                                                                PID:3492
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                  58⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:3064
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                    59⤵
                                                                                                                                                                      PID:5964
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                        60⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:944
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                          61⤵
                                                                                                                                                                            PID:616
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                              62⤵
                                                                                                                                                                                PID:2676
                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                  63⤵
                                                                                                                                                                                    PID:5636
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                    63⤵
                                                                                                                                                                                      PID:3036
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                        64⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:1464
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                          65⤵
                                                                                                                                                                                            PID:2440
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                              66⤵
                                                                                                                                                                                                PID:1640
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                  67⤵
                                                                                                                                                                                                    PID:3396
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                      68⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:3360
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                        69⤵
                                                                                                                                                                                                          PID:4664
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                            70⤵
                                                                                                                                                                                                              PID:1884
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                71⤵
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:2352
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                  72⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  PID:3140
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                    73⤵
                                                                                                                                                                                                                      PID:3912
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                          PID:5096
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                            75⤵
                                                                                                                                                                                                                              PID:4192
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                76⤵
                                                                                                                                                                                                                                  PID:3144
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                    77⤵
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:3416
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                      78⤵
                                                                                                                                                                                                                                        PID:860
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                          79⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:4432
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            PID:5628
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                              81⤵
                                                                                                                                                                                                                                                PID:4420
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                  82⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:5884
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                    83⤵
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:3756
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                      84⤵
                                                                                                                                                                                                                                                        PID:2420
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                          85⤵
                                                                                                                                                                                                                                                            PID:5492
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                              86⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:4280
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                87⤵
                                                                                                                                                                                                                                                                  PID:1712
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                                                                                      PID:3920
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                        89⤵
                                                                                                                                                                                                                                                                          PID:2104
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:3880
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                              91⤵
                                                                                                                                                                                                                                                                                PID:2300
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                  PID:2468
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                                                                                                      PID:6100
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                                                                                          PID:2272
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                                                                                                              PID:2412
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                                                                                                  PID:4480
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                                                                                                      PID:5468
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                                                                                                          PID:5824
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                                                                                                              PID:2704
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:3588
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                                                                                                    PID:4908
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                                                                                                        PID:2376
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                                                                                                                            PID:4600
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:2368
                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                                                                                                                  PID:2060
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                                                                                                                    PID:1248
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                      PID:3932
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                                                                                                                          PID:2460
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:5088
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                                                                                                                                PID:1096
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2148
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:6008
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1048
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                                                                                                                              PID:3176
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2052
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4764
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4092
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:3408
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                              117⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1168
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2660
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:4744
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1844
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:504
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4992
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1576
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2568
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5136
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:624
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1452
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4348
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5252
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3308
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4368
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4708
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                                      133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5764
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5900
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                            134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1208
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3348
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                              134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:872
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2688
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iKEwsUEc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4492
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                  135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3112
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2928
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                              133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5752
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2152
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qUAkIooI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2876
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5808
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2124
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eawsYgwA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                    131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1504
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5920
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3024
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5384
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5364
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4392
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wcIkUYEU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1664
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1900
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1972
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5808
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2472
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                      126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4100
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FQYAgsEA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                      126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3400
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                          127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1148
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5684
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5728
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bEcUwMEM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2096
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2168
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5244
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5760
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tEUEUUIU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1508
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:912
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:524
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5540
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2164
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2820
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pOMkkkEM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1904
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2124
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5000
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3412
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\egkccUIk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2504
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:872
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2132
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WOQQQoYI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5576
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1288
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1504
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SGEcgYcc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2516
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3520
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6104
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2400
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nKowgAEQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5536
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1284
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:720
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZOMYoIMY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1532
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5324
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5576
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2688
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4348
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4260
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xycEQMYQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2840
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5308
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5596
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1404
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LAQAsYEg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4112
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1808
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5268
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4764
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WugMoEwg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2400
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1676
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qQQwQQwQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6128
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:716
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5000
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1864
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3172
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qscUUkAA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2748
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5956
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4348
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WgccoUow.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5372
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4580
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3692
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jGMAIocc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:420
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1528
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                          97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4260
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5728
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1576
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5748
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tkUQUMwc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2768
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:716
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5984
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2660
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TGgQUQwk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3052
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LCAssckc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2964
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5172
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5292
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1272
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3352
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ucAsYMUM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                        89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3588
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3024
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                    86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2336
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wGUEsoko.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                    86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5168
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                        87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1664
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3308
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:872
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3820
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UQUoQAkI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2240
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5468
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4816
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5536
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                  82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3548
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JoAIkwUc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                  82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                    83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5364
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                              80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4492
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                              80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1532
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5540
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VSkYwwMg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1180
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                  81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5796
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                            78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4364
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                            78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3716
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                              78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2688
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DgAoAcYY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                  79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                            76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:792
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                            76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1196
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                            76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ziwQMMUI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                            76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5160
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                              77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3412
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1048
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                          74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3076
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                          74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                            74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2716
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gsEIUoAc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                            74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3340
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1404
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                          72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5808
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                          72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:624
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                          72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6104
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Sqgsossk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                          72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3060
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3820
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1904
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1932
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ewcEgcYc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                        70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5864
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3880
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6128
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rwckIggM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                      68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                        69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                  66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                    67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:712
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4808
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                        67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3120
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pGEQEAYU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                          66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5616
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                              67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1528
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NykUQIEA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5656
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                            65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                              65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1508
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                        62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4092
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                        62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5492
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                          62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4480
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jKQMMUAc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                          62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4232
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            63⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5372
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4368
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5808
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3300
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AaYgMYcU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                        60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5384
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2400
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1504
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gusYYQsI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                      58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                        59⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5884
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6128
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5252
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3176
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cacMUsIQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2268
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      57⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1744
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1640
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                  55⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3876
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4812
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NaoUIQYQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      55⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2164
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2152
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2052
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vuUoUgUM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1540
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                    53⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                              50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2772
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                              50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5984
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                              50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3420
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PmEIAkEc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                              50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4956
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                  51⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1196
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                            48⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6104
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                            48⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5808
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                            48⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4368
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SYIogsks.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                            48⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1252
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                49⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1224
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                  49⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3140
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                            46⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3620
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                            46⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4532
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                            46⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                              47⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3112
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qkwAQgwE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                              46⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4616
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                47⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1676
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3172
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5748
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2748
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yEwMMcAo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3432
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              45⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1452
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                        42⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5928
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        42⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                        42⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KIosQoYg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          42⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                            43⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:712
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                      40⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3120
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                      40⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4392
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                        40⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1900
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CawMwwws.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                        40⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5156
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                            41⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1964
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1968
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                        38⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zmAYYQIo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                        38⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1200
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          39⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1508
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    36⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2468
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    36⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3912
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      36⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2060
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Zikcogoc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      36⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        37⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3036
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  34⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2400
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  34⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1944
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    34⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5752
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tMAIQQQg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    34⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4748
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                      35⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4712
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        35⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1904
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ucQosEgM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      33⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1864
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                30⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6108
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                30⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3876
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  30⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\esAsUIMM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  30⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:908
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4808
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3972
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                28⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                28⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2000
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                28⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3880
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qKYkIggc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                28⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3892
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  29⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4200
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            26⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5712
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            26⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5492
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                            26⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1168
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HAkYYEIg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                            26⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2016
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                              27⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2152
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                        24⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3660
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                        24⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2504
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                          24⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3348
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JWgUwQIU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                          24⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                            25⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2440
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                      22⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1704
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                      22⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                        22⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4444
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZaccokMg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                        22⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                          23⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                    20⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4644
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    20⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1504
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3432
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aIcUYssg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:808
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                        21⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                        PID:720
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                  18⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3396
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                  18⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5000
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                  18⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1404
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KiooMQMM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                  18⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3948
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                      19⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5764
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3516
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                  PID:420
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PKsQwgcg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2860
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                    17⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4996
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                              PID:4948
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2888
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                PID:5084
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LUMMEcgA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3412
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            PID:1224
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:3340
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:3168
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TUAAIYcQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                              PID:4132
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                PID:4172
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          PID:5728
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                          PID:3112
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                          PID:6076
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nOMcYcIo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                          PID:3336
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:3660
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                      PID:1904
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4420
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                        PID:4800
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uAgckkcg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                        PID:6132
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          PID:4712
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    PID:2148
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4808
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                      PID:1784
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qiAQAEcw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                      PID:4468
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                        PID:2508
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                  PID:5672
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:5608
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  PID:6128
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RmAossMM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                  PID:5908
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                    PID:5268
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:2016
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:3908
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:3412
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ASwoQEAo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                              PID:5104
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                PID:5848
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\bmUIQYss\riogsAMk.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\bmUIQYss\riogsAMk.exe
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                            PID:4660
                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\oaAQMYsk\CasQgwkI.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\ProgramData\oaAQMYsk\CasQgwkI.exe
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:1360

                                                                                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                Resource Development

                                                                                                                                                                                                                                                                                                                                                                                Initial Access

                                                                                                                                                                                                                                                                                                                                                                                Execution

                                                                                                                                                                                                                                                                                                                                                                                Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                T1059

                                                                                                                                                                                                                                                                                                                                                                                Visual Basic

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1059.005

                                                                                                                                                                                                                                                                                                                                                                                Windows Command Shell

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1059.003

                                                                                                                                                                                                                                                                                                                                                                                Persistence

                                                                                                                                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                                                                                                                                Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1548

                                                                                                                                                                                                                                                                                                                                                                                Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1548.002

                                                                                                                                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                                                                                                                                Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1548

                                                                                                                                                                                                                                                                                                                                                                                Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1548.002

                                                                                                                                                                                                                                                                                                                                                                                Hide Artifacts

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1564

                                                                                                                                                                                                                                                                                                                                                                                Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1564.001

                                                                                                                                                                                                                                                                                                                                                                                Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1562

                                                                                                                                                                                                                                                                                                                                                                                Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1562.001

                                                                                                                                                                                                                                                                                                                                                                                Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                4
                                                                                                                                                                                                                                                                                                                                                                                T1112

                                                                                                                                                                                                                                                                                                                                                                                Credential Access

                                                                                                                                                                                                                                                                                                                                                                                Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1555

                                                                                                                                                                                                                                                                                                                                                                                Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1555.003

                                                                                                                                                                                                                                                                                                                                                                                Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1552

                                                                                                                                                                                                                                                                                                                                                                                Credentials In Files

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1552.001

                                                                                                                                                                                                                                                                                                                                                                                Discovery

                                                                                                                                                                                                                                                                                                                                                                                System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1082

                                                                                                                                                                                                                                                                                                                                                                                System Location Discovery

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1614

                                                                                                                                                                                                                                                                                                                                                                                System Language Discovery

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1614.001

                                                                                                                                                                                                                                                                                                                                                                                Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                Collection

                                                                                                                                                                                                                                                                                                                                                                                Data from Local System

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1005

                                                                                                                                                                                                                                                                                                                                                                                Command and Control

                                                                                                                                                                                                                                                                                                                                                                                Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                Impact

                                                                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                                                                CasQgwkI.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\oaAQMYsk\CasQgwkI.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 203KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 3593387c4df42fdf4bab2d48bedb891f3599b5422aaa622582392f3cf9d326a6
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                CasQgwkI.inf
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\oaAQMYsk\CasQgwkI.inf
                                                                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 1ff741e277f0ec0a6ced85317e677cc030618964861f4372a10ef340137722c2
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                CasQgwkI.inf
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\oaAQMYsk\CasQgwkI.inf
                                                                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 3eeff0ba9c41b1c3a5ef10fbebeb39def0e53f31ac1fdfe56321bbbd9a9197c0
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                CasQgwkI.inf
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\oaAQMYsk\CasQgwkI.inf
                                                                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 7528027d813297afec0c3397b722fef30fd078c2056189b56c32f36284218549
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                CasQgwkI.inf
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\oaAQMYsk\CasQgwkI.inf
                                                                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 7169113b35fa81c22e05bd75da7024c6bc5d2379a41fb272880cbf7354c29acd
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                • Size 588KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 60ff5131dba68a8ffe7ba0475bf3e192b432e1969e5ac52d7f217f6935f4035d
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                AAAG.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\AAAG.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 187KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 ba6554b1e813337753a1e60b0d3ae760ad5085c6675ca2704e81fd65806a6909
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                AMwo.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\AMwo.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 190KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 798fc4eac314889a8f14448d1f1fdeb1dc247e1c289f3fed4402978e5c4776c7
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                AQIO.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\AQIO.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 349KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 aaeaa0abbec08efac00eef23737c1b4fee18c3d6ac9ad4a4adeb354a4274a8eb
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                ASwoQEAo.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ASwoQEAo.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 112B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                AUQE.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\AUQE.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 733KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 d7405b0e62699423941900d8747512afbc276c7a7ecc51aad782ac1ab6213653
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                Aggs.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\Aggs.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 589KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 72da48e9f0914f06d36e15f45ee21b8e8e9b7f83b9c9d45662e1b07dfad4f00b
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                EMcc.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\EMcc.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 202KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 a1ff020b978e9347fdbf1970291bf267cd02f0760c4baa8c910041dc73cc85ab
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                EUYU.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\EUYU.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 566KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 4bc9ebf2bc0178f9d58a5f1db708abd0d7928638c27a24bdd3f4cbde91c6700c
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                EUog.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\EUog.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 1.4MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 1e01285d52ed0815854994d3f1323bf52a499db3a4ddeb9cc86d04001ee7a45d
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                EYYS.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\EYYS.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 418KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 c527185e13ca45a4f6a21cdda2caf13b14a0aad487958d8d05f10dfed7bc28a9
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                GIQy.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\GIQy.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 201KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 6ff243c09905090cfd512c176663370ba7f1eda2d63f538c2ecbc14b624cc63c
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                Gggm.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\Gggm.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 414KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 5699fc7cd7d0f4f104705617d1ac9f2258937a0dd8dcbc0c2089ac78df77f7e0
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                GokW.ico
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\GokW.ico
                                                                                                                                                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                GsAO.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\GsAO.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 660KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 ae85dcc75d21bb5cdda81c41141c43a783ad8057b990d5c7fca23835e5c6ab67
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                GwYE.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\GwYE.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 370KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 07cc718f07e5d39ca8effcd978421f482e15375c418a23d513a40b26c4873c55
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                IEEy.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IEEy.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 525KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 d02d06a5aa70d4720e977d22e636c3439b67cd369749e58317bcf543835ed7ef
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                IMoY.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IMoY.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 642KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 03af061152b5d17d5189a2a49aa5ec00db919f952b3b6e9ad0d6fdfde0d58f9b
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                Ikog.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\Ikog.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 205KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 d4de0447065840f75cbaad6c2bec499a0c2bd8d22998b2b1430ecf245d30e103
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                IoEo.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IoEo.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 228KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 67257413128702e9ef351204076982d6a5b2aaef26f95e86debc0c849c9fd9dd
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                IoYS.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IoYS.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 1014KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 88187e7b743e242a19044c40fe3deb2670c4b589839ac215fb6fd181970fc542
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                IsAc.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IsAc.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 213KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 b8a57e09d684b38d379704cfc7b80524d46e4b611dd6c39eb57824e45695899c
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                KEgy.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\KEgy.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 588KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 55435574d0a8370ccfdea9103f326ffc22bf9946d07214d4c66bbe62bf5ab1e7
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                KkkW.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\KkkW.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 580KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 19186a1d9b06b076b699406744acb5c4310de4ec3b13973f2ed90f026d5e8078
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                KwoQ.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\KwoQ.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 423KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 75b405d8fe8d073a2a1adbf83285f3bf899fe12fa615a4e1e3db91fd3672e48a
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                MEAC.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\MEAC.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 796KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 c3ec4ee5d250e496d6e16ce804b50b30512575dee227eeadc2069828b201e9bb
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                MEcs.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\MEcs.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 635KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 64bc54ae14fb87c889064f5f41b0e7d1f0ff2f5cf89bc44cc321f23d475ee157
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                MUUc.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\MUUc.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 309KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 ee348fa7705b7ed40eaea8f37a4c8bcc786316d47e8caf502218b10614ffb0be
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                OgIG.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\OgIG.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 203KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 b5970499b4c99dd83020ad05d4ebd96b6821b9d73fc158b784910939457cf7fb
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                OsUG.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\OsUG.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 204KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 dc68a75fe5f6932030f5fa360c34ca9b77993d8ff408407671cafe6d7a9a6bac
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                OsgI.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\OsgI.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 1.3MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 3bd751a1e347339440e1aaea0e2deb4462f63cae655bc1ef44ec853eb4e0af77
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                QAkm.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\QAkm.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 826KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 ec51bc35f811e1332dc74fe43b6024c9a8ed7cbb9e138e0bda80a20c53401db0
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                QMoa.ico
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\QMoa.ico
                                                                                                                                                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 bc4ed7d844af9da0a5d2fe12e8db07fbfdf6e0ecd557223b292bd0e9cb6a64a1
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                SUIC.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\SUIC.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 346KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 7a76668764bde91bc04a57e3bb8f6e453231500dceed5b440747fa615100f52c
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                SYwy.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\SYwy.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 188KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 5573dc195c6f6d60ddb5a2f6d9893026ebb18499bd4cc607ce8c6da9dc63526f
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                UAYa.ico
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\UAYa.ico
                                                                                                                                                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                UQko.ico
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\UQko.ico
                                                                                                                                                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                WQIs.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\WQIs.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 652KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 3a85cc43671fdc0a536a58af1626ac6f7cd88bf9b5ca057e8d9867c72d4bae7b
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                WQkG.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\WQkG.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 572KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 fd72933eaf58d2fcc00e60c1d7aff64491daf123de354f02aa31ff6acd302903
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                Wkwa.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\Wkwa.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 183KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 0be0805cd3dc866fe3eda51e0a5a26cf8f2a72f4df242bed6a07bf766554f067
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                WoQK.ico
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\WoQK.ico
                                                                                                                                                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                WsMk.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\WsMk.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 185KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 f8cd49a67c585a05313bf2219d5e6a8f236b9f82bb7bd2fc04d32339ce639937
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                YAAE.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\YAAE.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 372KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 72d9ff9bb87360ef63dd00c655d6dd761d9a124a9fcc10e00fcf815bd66b1ce2
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                YAkA.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\YAkA.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 219KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 045c45b4895e583373e649cb9fccdfb7b0342e69e77fd6d6e2bb8386570896cf
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                YEgg.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\YEgg.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 657KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 cc6f93386368f468b86413b919763e4974d54f18bd96be03b5fb1487cee1120d
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                YkEu.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\YkEu.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 1.3MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 6f8f055fec83085f0e61d51097db59b24070a2419c34906456c8acb6f1b04a70
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                YkgK.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\YkgK.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 623KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 33680dde7dae6b005d97e1487e1ff923246a64c355ca8d73bf5afa73b4300ac1
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                aAoQ.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\aAoQ.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 198KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 207f75311358a3ad6b4a2743f15b4b8ca798e8235c56ce717626d4c5c2283561
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                aYYU.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\aYYU.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 229KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 23ed0736def97f561bc877ae8c4a290cd8fae90711f62820c21c5d903c775896
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                aYgM.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\aYgM.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 189KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 e8729ea312d6f00fa34d55623b188dfd50c3ee1586810fb1095cbfa5f46fbd56
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                acQM.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\acQM.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 670KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 770d678203aa1c5836113ddf79d133c42081576843b7e248449ceb28078551e8
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                cAwi.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\cAwi.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 825KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 daafbf7fce1924d7d770e3d58d985f106daff63987eca2259a70c1a94c3906f9
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                cUUO.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\cUUO.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 328KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 6d568b42cc52e8a7601e143a86295df09186bdc7c6aebc3be4ea8e5448335cc9
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                cUYs.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\cUYs.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 205KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 dd2a9401d42733918c4e0bee635bc0ed06fafbeaed2bd1728d9f9a3e5a2083c0
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                cogy.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\cogy.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 575KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 55745feb01df28b69d3100640649b923ac20bbd338af539d45c430868d0fda84
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                eQQA.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\eQQA.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 808KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 2985de6a7d800968ed0e1aac1903b120dbdac6285399ec63ec181b908f6d4168
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                eYQW.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\eYQW.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 372KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 775304839630e666cb4f1f8e583b8dbf15547e9ec34d882519cf5c0a6a40bbf2
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                file.vbs
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                                                                                                                                                                                                                                                                                                                • Size 19B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                gEoW.ico
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\gEoW.ico
                                                                                                                                                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 9a233711400b52fc399d16bb7e3937772c44d7841a24a685467e19dfa57769d5
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                gMkC.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\gMkC.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 194KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 6a1f2771118cb704b976ff4153ef3f7d53bf10adefe498194aa9a2c7b0b5ade2
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                gQAy.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\gQAy.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 689KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 d00e271ae715bfde518ddc8ac97939285417943ad0ec7769819b465bc548138f
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                gUwQ.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\gUwQ.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 197KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 c61b29b19d291ad3c84b3ced9a81ced638db14903591b28fe64b638dda092123
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                gswQ.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\gswQ.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 305KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 3c6618b9895ebe68a05bc4f0898a0bfebff5d868510fc3e2cc1cd14753ec34cc
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                iQYU.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\iQYU.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 402KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 01ccf34bdf2540948e86ee3e0080c3dce2066c7b162fe30072c5a30e679a7cdb
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                kIAC.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\kIAC.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 1.1MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 d68ba179f0d34ebda6969eda990cab084f6c072f0fb3ad5c68bfc1ae22dfc452
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                koAA.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\koAA.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 499KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 ba7db0f3d057b49371fbf41695ee56b493f72ca9cd4428ce33fbc28a8d774d4f
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                ksIA.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ksIA.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 629KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 ead50df92173ab8e705c8bcdc168f16e2baef6c31c469a1039f988c01543e6fd
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                mYQa.ico
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\mYQa.ico
                                                                                                                                                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                mgAk.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\mgAk.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 800KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 71130f1ca4992d82cb4e21b41734138c5e5a065dcbbc42e0259be755eb25730b
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                mgIS.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\mgIS.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 357KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 56fc613638441f8c7c0054bb2c99345c5ec0fab23e1962439ac05c0b405d8abf
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                mowo.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\mowo.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 213KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 2a699c8d10d4aa3f9f271e425560d9b506db045937ae2ee79c96fc326524070b
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                mwsa.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\mwsa.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 954KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 4009dffca27cfeebb9ba0ce8d4becc12a86253b0f7af7886ae703118dfdafa9f
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                oQkq.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\oQkq.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 1.2MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 4b5ff53fa3cdd4a737e72aec145d76b6ce2223ae6774b449f14ccecd9a92074b
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                ocQc.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ocQc.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 1.1MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 663051b0dda6b9fae88c8eafa158de3ffaff73f55ed851a3565df2a949d52912
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                ocYO.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ocYO.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 452KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 d37816e198251b9b25a6f028ba6ac7e2160de36c5f117e8e015be7bfcec5f68c
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                ogsk.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ogsk.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 616KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 c15bf6d4b5ee1f7466a2b6c0e8fae72f28f8fcfc7e29707f3a5db9e47c05961d
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                owEW.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\owEW.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 423KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 27e681e9e4c9608fe2b7a809b1652712032bdd2405c530bf089a920ec2ff827b
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                qIow.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\qIow.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 191KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 5234a03ad9650dc83523b7f8ea09368002c0942749d7925cc37a88c5b1c07361
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                qQwA.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\qQwA.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 222KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 09aa6f8453321bdaf0f2836d5503af2c8f90e876d414ae353148b82d7822fb6d
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                qcII.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\qcII.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 306KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 6ed5a9694c1aea67e3b5a8c4770e4e5e01c6e7b8530305bf3201f848941fe4a5
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                qcwc.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\qcwc.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 744KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 fad633e6d4f6df439bd424cca2ead81d36ba9579536ebacc5244c7329162c1a7
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                qowW.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\qowW.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 198KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 3e3f33b487dc5fe723e429cece111e05e40921fb1b08a31c1735362af13035d1
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                qwQo.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\qwQo.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 21da3eb1a59a4aec92dc54302673335f8017d04d40a6f72241dd9886107224f9
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                soEA.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\soEA.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 1001KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 dc81a33193b912e4bee557b8489ae937c6235b8ea5f58f25a1d3f82c07bd4db6
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                uIMC.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\uIMC.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 487KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 bdd3993c4d73326119141ed35feb9acf70b0a4973c880fe52235c7bcf49d597d
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                uIsQ.ico
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\uIsQ.ico
                                                                                                                                                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                uUQa.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\uUQa.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 754KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 2ec47f50ed751d0ded898112cb1ea5ee58ab752e436e49da4786e0bbb4cc49be
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                ukcs.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ukcs.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 215KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 684184968ea141c82b789bb625c96ef6c3594fc1548e24efdb7759b6784c74b9
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                uwIS.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\uwIS.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 200KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 bd3936ae12596e9e03597193ffa903616e12865db2c736f908d5ac7d6d9d138a
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                wAYc.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wAYc.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 707KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 d534888711bfb5d11ca2d6c65344b0b179ac893229e1cbb1de0819bdf88d9b7e
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                wEgO.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wEgO.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 1.2MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 83681a376d3708a6abb10fd251f02e3543566c5b447d0faf01ff686a5e07f428
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                wIsw.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wIsw.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 201KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 e34d950990d979c524b15c798378d294b84f046aaf8338442bf1298c23d5ed8f
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                wMgu.ico
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wMgu.ico
                                                                                                                                                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                wcwi.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wcwi.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 200KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 3edb56d7c08922b1e4e988c54d4536fab9f52c69265bccf54eb184b69a5b200a
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                wkYU.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wkYU.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 235KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 64719af6eaaff52a21d0e71c75a89867eb69572d6fadacbf3c23e461ef30313e
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                wwoU.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wwoU.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 197KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 8f39111f0d4b6c68e0e9c8ad02c50cadea8efed35d68c628138e589da30457ea
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                yIAg.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\yIAg.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 794KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 cbcd5d3d9f894a465e9fba19de10e1fcd2d8f8682d9ea92a6163a27074fdd2b4
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                yMcm.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\yMcm.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 198KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 770e52c4565400417e41e43505ceff39bedb8c834433d8e961cfdd69411c5014
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                ycYU.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ycYU.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 365KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 3b63155daa58507002bf2d06313f3f5ab8031b4415f353ea6603d0ddf40ccc8e
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                riogsAMk.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\bmUIQYss\riogsAMk.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 181KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 d6b7a55eb431118f960047a62e40a9eabf35c2126644f4f726c883fb8a1432f0
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                riogsAMk.inf
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\bmUIQYss\riogsAMk.inf
                                                                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 87a890f560173f161cef96c8b87e0fc4d855c53e35732d97e370130fb7449d0f
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                riogsAMk.inf
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\bmUIQYss\riogsAMk.inf
                                                                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 348a1b08d33335c4788a9f15fd645f17f883ac68e823fef552e5f1be6b4be348
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                memory/616-397-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/624-721-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/704-1448-0x0000000000400000-0x0000000000434000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/704-17-0x0000000000400000-0x0000000000434000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/916-10-0x0000000000400000-0x000000000042F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/916-1303-0x0000000000400000-0x000000000042F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1096-639-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1248-619-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1264-190-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1312-73-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1344-145-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1360-1753-0x0000000000400000-0x0000000000434000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1444-294-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1460-161-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1712-528-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/1844-690-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2104-539-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2264-178-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2264-162-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2296-117-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2300-548-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2352-446-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2384-131-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2412-569-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2440-417-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2456-324-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2460-628-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2484-314-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2544-206-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2568-710-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2660-679-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2704-588-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/2980-263-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3036-393-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3036-406-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3176-659-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3184-274-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3284-57-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3304-89-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3396-426-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3416-477-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3492-374-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3664-284-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3756-508-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3888-254-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3912-457-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/3964-354-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4092-670-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4192-468-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4200-303-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4348-731-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4368-751-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4388-101-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4420-499-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4432-488-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4540-222-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4600-608-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4660-27-0x0000000000400000-0x000000000042F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4660-1667-0x0000000000400000-0x000000000042F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4664-437-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4668-741-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4668-727-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4752-365-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4856-234-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4908-599-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4912-41-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4992-699-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5052-334-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5440-22-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5440-0-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5468-579-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5492-518-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5764-762-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5764-747-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5792-244-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5816-345-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/5964-385-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/6008-650-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/6100-559-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download